CVE-2025-37731
CVE-2025-37731 · Elasticsearch Improper Authentication
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
CVSS 6.8 · Medium · EPSS 0.2%
- Published
- Updated
Stack: system
Affected products and versions
elasticsearch
- Versions
- ≥ 7.0.0, ≤ 7.17.29: Affected (semver)
- ≥ 8.0.0, ≤ 8.19.7: Affected (semver)
- ≥ 9.0.0, ≤ 9.1.7: Affected (semver)
- ≥ 9.2.0, ≤ 9.2.1: Affected (semver)
No fix published
elasticsearch Ubuntu:16.04:LTS
- Versions
- 1.6.2+dfsg-1
- 1.7.3+dfsg-1
- 1.7.3+dfsg-2
- 1.7.3+dfsg-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published