Описание
An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that results in that user gaining elevated privileges.
Ссылки
- MitigationVendor Advisory
- MitigationVendor Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:elastic:x-pack:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.1.1:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.2.1:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.2.2:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.3.0:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.3.1:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.3.2:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.3.3:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.4.0:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.5.0:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.5.2:*:*:*:*:*:*:*
cpe:2.3:a:elastic:x-pack:5.6.0:*:*:*:*:*:*:*
EPSS
Процентиль: 54%
0.00308
Низкий
8.8 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-284
CWE-269
Связанные уязвимости
CVSS3: 8.8
debian
больше 8 лет назад
An error was found in the permission model used by X-Pack Alerting 5.0 ...
CVSS3: 8.8
github
больше 3 лет назад
An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that results in that user gaining elevated privileges.
EPSS
Процентиль: 54%
0.00308
Низкий
8.8 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-284
CWE-269