Описание
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.
Ссылки
- ExploitThird Party AdvisoryVDB Entry
- Vendor Advisory
- Third Party Advisory
- ExploitThird Party AdvisoryVDB Entry
- Vendor Advisory
- Third Party Advisory
Уязвимые конфигурации
EPSS
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
Связанные уязвимости
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.
Уязвимость облачной платформы аналитики Elastic Cloud Enterprise, связанная с ошибками в настройках безопасности, позволяющая нарушителю получить доступ к защищаемой информации
EPSS
7.5 High
CVSS3
5 Medium
CVSS2