CVE-2017-8446CWE-522

CVE-2017-8446: fallo en Elastic X-Pack Reporting

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Elastic X-Pack Reporting+ Monitorear org.elasticsearch.plugin:x-pack

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 0.7%
The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reporting_user role could execute a report with the permissions of another reporting user, possibly gaining access to sensitive data.
Productos afectados
Elastic · Elastic X-Pack Reporting