CVE-2017-8441 Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data....
MediumCVSS 4.3
EPSS 0.73%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Elastic x-pack | >= 5.3.0, < 5.3.3 | 5.3.3 |
| Elastic x-pack | >= 5.4.0, < 5.4.1 | 5.4.1 |
| Elastic X-Pack Security | = prior to 5.4.1 and 5.3.3 | No fix listed |
References
- discuss.elastic.co vendor-advisory
- www.elastic.co release-notes vendor-advisory
- www.elastic.co vendor-advisory