CVE-2022-23708

MEDIUM4.3EPSS 0.24%

Elasticsearch privilege escalation

Published: 3/4/2022Modified: 4/3/2025

Also known as:GHSA-pgq6-ccqj-hpqrBIT-elasticsearch-2022-23708

Description

A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.

Affected packages (2)

Bitnami/elasticsearch>= 7.16.0, < 7.17.1
Maven/org.elasticsearch:elasticsearch>= 7.16.0, < 7.17.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-23708
WEBhttps://discuss.elastic.co/t/elastic-stack-7-17-1-security-update/298447
WEBhttps://security.netapp.com/advisory/ntap-20220729-0003
WEBhttps://security.netapp.com/advisory/ntap-20220729-0003/