CVE-2017-8446

The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reporting_user role could execute a report with the permissions of another reporting user, possibly gaining access to sensitive data.

Score

CVSS 3.0 5.3 Medium

Status

Modified - security@elastic.co

Published

2017-08-18

Last modified

2024-08-05

Weaknesses

CWE-269, CWE-522

Affected products

• Elastic X-pack Reporting (Elastic)
• X-pack (Elasticsearch)
• X-pack Reporting (Elasticsearch)

References

• https://www.elastic.co/community/security