CVE-2025-37731CWE-287

CVE-2025-37731

Medium · published December 15, 2025

CVSS v3.1
6.8
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00192 · 8.4th percentile
Weakness
CWE-287 · Improper Authentication
Published
2025-12-15T16:15Z
Affected products (4)
ProductVersionsFixed in
elastic/elasticsearch≥ 7.0.0, ≤ 7.17.29—
elastic/elasticsearch≥ 8.0.0, < 8.19.88.19.8
elastic/elasticsearch≥ 9.0.0, < 9.1.89.1.8
elastic/elasticsearch≥ 9.2.0, < 9.2.29.2.2
References (1)
https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063 · [email protected]
EPSS history
Timeline
  • 15 DEC 10:42Z
    Elasticsearch Improper Authentication
    cvelistv5