Incorrect Authorization Affecting org.elasticsearch:elasticsearch package, versions [8.10.0,8.13.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGELASTICSEARCH-6508638
- published 28 Mar 2024
- disclosed 27 Mar 2024
- credit Unknown
Introduced: 27 Mar 2024
CVE-2024-23451 Open this link in a new tabHow to fix?
Upgrade org.elasticsearch:elasticsearch to version 8.13.0 or higher.
Overview
org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.
Affected versions of this package are vulnerable to Incorrect Authorization in the API-key-based security model for Remote Cluster Security (in beta). This allows a malicious user with a valid API key for a remote cluster configured to use Remote Cluster Security to read arbitrary documents from any index on the remote cluster, using the Elasticsearch custom transport protocol to issue requests with the target index ID, the shard ID, and the document ID.
Note:
None of the Elasticsearch REST API endpoints are affected by this issue.