CVE-2024-12539
CVE-2024-12539 · Elasticsearch Incorrect Authorization
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.
CVSS 6.0 · Medium · EPSS 0.5%
- Published
- Updated
Stack: system
Affected products and versions
elasticsearch
- Versions
- ≥ 8.16.0, ≤ 8.16.1: Affected (semver)
No fix published
elasticsearch Ubuntu:16.04:LTS
- Versions
- 1.6.2+dfsg-1
- 1.7.3+dfsg-1
- 1.7.3+dfsg-2
- 1.7.3+dfsg-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published