This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Elasticsearch fixes 2 vulnerabilities
An authenticated remote attacker can carry out a DoS attack by repeatedly processing a file [1].
The vulnerability is present in product:
- Elasticsearch; >=7.0.0, <7.17.19; >=8.0.0, <8.13.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-23450 at cve.org, NVD
- CWE-400 at cwe.mitre.org
The vulnerability was publicly disclosed 27. 3. 2024.
An authenticated remote attacker holding an API key for a remote cluster can, under certain circumstances, view arbitrary documents from that cluster without authorization [2].
The vulnerability is present in product:
- Elasticsearch; >=8.10.0, <8.13.0;
CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2024-23451 at cve.org, NVD
- CWE-863 at cwe.mitre.org
The vulnerability was publicly disclosed 27. 3. 2024.
Elastic fixes 2 vulnerabilities in the Elasticsearch product in version 8.13.0 [2][1].
Links
By CESNET, z.s.p.o. Martin Krajči on 28. 3. 2024.