{"containers": {"cna": {"affected": [{"product": "Search Guard", "vendor": "floragunn", "versions": [{"lessThan": "24.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user when field level security (FLS) is activated."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-08-12T20:51:23", "orgId": "9f311a02-c44f-4938-8530-9219246b8255", "shortName": "floragunn"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://search-guard.com/cve-advisory/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_0"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@search-guard.com", "ID": "CVE-2019-13417", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Search Guard", "version": {"version_data": [{"version_affected": "<", "version_value": "24.0"}]}}]}, "vendor_name": "floragunn"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user when field level security (FLS) is activated."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-863: Incorrect Authorization"}]}]}, "references": {"reference_data": [{"name": "https://search-guard.com/cve-advisory/", "refsource": "MISC", "url": "https://search-guard.com/cve-advisory/"}, {"name": "https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_0", "refsource": "CONFIRM", "url": "https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_0"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T23:49:24.956Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://search-guard.com/cve-advisory/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_0"}]}]}, "cveMetadata": {"assignerOrgId": "9f311a02-c44f-4938-8530-9219246b8255", "assignerShortName": "floragunn", "cveId": "CVE-2019-13417", "datePublished": "2019-08-12T20:51:23", "dateReserved": "2019-07-08T00:00:00", "dateUpdated": "2024-08-04T23:49:24.956Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:search-guard:search_guard:*:*:*:*:*:*:*:*", "matchCriteriaId": "37A2E496-23EC-403E-97CE-3E70C76AB320", "versionEndExcluding": "24.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user when field level security (FLS) is activated."}, {"lang": "es", "value": "Las versiones de Search Guard anteriores a la versi\u00f3n 24.0 ten\u00edan el problema de que los l\u00edmites de campo y los nombres de campo de fuga de API de mapeo (pero no los valores) para los campos que no est\u00e1n permitidos para el usuario cuando la seguridad de nivel de campo (FLS) est\u00e1 activada."}], "id": "CVE-2019-13417", "lastModified": "2023-03-02T17:59:10.467", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-08-12T21:15:15.407", "references": [{"source": "security@search-guard.com", "tags": ["Release Notes"], "url": "https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_0"}, {"source": "security@search-guard.com", "tags": ["Vendor Advisory"], "url": "https://search-guard.com/cve-advisory/"}], "sourceIdentifier": "security@search-guard.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@search-guard.com", "type": "Secondary"}]}

{"bugzilla": {"description": "search-guard: information disclosure in field level security (FLS)", "id": "1749222", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1749222"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-200", "details": ["Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user when field level security (FLS) is activated."], "name": "CVE-2019-13417", "package_state": [{"cpe": "cpe:/a:redhat:openshift:3.10", "fix_state": "Not affected", "package_name": "openshift-elasticsearch-plugin", "product_name": "Red Hat OpenShift Container Platform 3.10"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Will not fix", "package_name": "openshift3/ose-logging-elasticsearch5", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:3.9", "fix_state": "Not affected", "package_name": "openshift-elasticsearch-plugin", "product_name": "Red Hat OpenShift Container Platform 3.9"}, {"cpe": "cpe:/a:redhat:openshift:3.9", "fix_state": "Not affected", "package_name": "search-guard", "product_name": "Red Hat OpenShift Container Platform 3.9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "package_name": "openshift4/ose-logging-elasticsearch5", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2019-08-13T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-13417\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-13417\nhttps://search-guard.com/cve-advisory/"], "threat_severity": "Low"}