CVE-2017-8441 - Vulnerability Details - OpenCVE

Description

Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias.

Published: 2017-06-05

Score: 4.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Elastic

X-Pack Security

affected

Version	Status	Constraints
`prior to 5.4.1 and 5.3.3`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:elastic:x-pack::::::::
	cpe:2.3:a:elastic:x-pack::::::::

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2017-17392	Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00133.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952
https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released
https://www.elastic.co/community/security

History

No history.

Subscriptions

Elastic X-pack

MITRE

Status: PUBLISHED

Assigner: elastic

Published: 2017-06-05T14:00:00.000Z

Updated: 2024-08-05T16:34:22.945Z

Reserved: 2017-05-02T00:00:00.000Z

Link: CVE-2017-8441

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-06-05T14:29:00.387

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-8441

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"containers": {"cna": {"affected": [{"product": "X-Pack Security", "vendor": "Elastic", "versions": [{"status": "affected", "version": "prior to 5.4.1 and 5.3.3"}]}], "datePublic": "2017-06-01T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-279", "description": "CWE-279: Incorrect Execution-Assigned Permissions", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2017-06-05T13:57:01.000Z", "orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "shortName": "elastic"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.elastic.co/community/security"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@elastic.co", "ID": "CVE-2017-8441", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "X-Pack Security", "version": {"version_data": [{"version_value": "prior to 5.4.1 and 5.3.3"}]}}]}, "vendor_name": "Elastic"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-279: Incorrect Execution-Assigned Permissions"}]}]}, "references": {"reference_data": [{"name": "https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952", "refsource": "CONFIRM", "url": "https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952"}, {"name": "https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released", "refsource": "CONFIRM", "url": "https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released"}, {"name": "https://www.elastic.co/community/security", "refsource": "CONFIRM", "url": "https://www.elastic.co/community/security"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T16:34:22.945Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.elastic.co/community/security"}]}]}, "cveMetadata": {"assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "assignerShortName": "elastic", "cveId": "CVE-2017-8441", "datePublished": "2017-06-05T14:00:00.000Z", "dateReserved": "2017-05-02T00:00:00.000Z", "dateUpdated": "2024-08-05T16:34:22.945Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elastic:x-pack:*:*:*:*:*:*:*:*", "matchCriteriaId": "0534BA87-10F3-406A-B6FC-4AF767F5D6C9", "versionEndExcluding": "5.3.3", "versionStartIncluding": "5.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:elastic:x-pack:*:*:*:*:*:*:*:*", "matchCriteriaId": "0B45E754-714A-4959-9BBB-526B2B3824FC", "versionEndExcluding": "5.4.1", "versionStartIncluding": "5.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias."}, {"lang": "es", "value": "Elastic X-Pack Security versiones anteriores a 5.4.1 y 5.3.3 no siempre aplicaban correctamente la Seguridad de Nivel de Documento para los alias de \u00edndices. Este error podr\u00eda permitir a un usuario con permisos restringidos visualizar datos a los que no deber\u00eda tener acceso cuando realiza ciertas operaciones contra un alias de \u00edndice."}], "id": "CVE-2017-8441", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-06-05T14:29:00.387", "references": [{"source": "bressers@elastic.co", "tags": ["Vendor Advisory"], "url": "https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952"}, {"source": "bressers@elastic.co", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released"}, {"source": "bressers@elastic.co", "tags": ["Vendor Advisory"], "url": "https://www.elastic.co/community/security"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.elastic.co/community/security"}], "sourceIdentifier": "bressers@elastic.co", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-279"}], "source": "bressers@elastic.co", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}