CVE-2017-8438
Published Jun 5, 2017
Last updated 5 years ago
Overview
- Description
- Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specified user specified in a run_as request. If a role has been created using a template that contains the _user properties, the behavior of run_as will be incorrect. Additionally if the run_as user specified does not exist, the transition will not happen.
- Source
- bressers@elastic.co
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.0
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 6.5
- Impact score
- 6.4
- Exploitability score
- 8
- Vector string
- AV:N/AC:L/Au:S/C:P/I:P/A:P
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elastic:x-pack:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C15893C0-5FFF-4A60-940F-C69EBF60CE62"
},
{
"criteria": "cpe:2.3:a:elastic:x-pack:5.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BFE40EC5-19CF-4DDC-98CF-DEA035CBBDED"
},
{
"criteria": "cpe:2.3:a:elastic:x-pack:5.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F2ABFD3F-65B8-45CA-8AA0-DD9FC0E668E5"
},
{
"criteria": "cpe:2.3:a:elastic:x-pack:5.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "26C9B833-CFB8-4CC3-A28D-E5320276E5D6"
},
{
"criteria": "cpe:2.3:a:elastic:x-pack:5.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "444B1E15-1BEF-479B-8DEA-1DB5ACE7C051"
},
{
"criteria": "cpe:2.3:a:elastic:x-pack:5.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BF9945D4-5B3B-41B3-9F94-DB11A8F7E262"
},
{
"criteria": "cpe:2.3:a:elastic:x-pack:5.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C26D394C-DE12-489F-B7E1-DF4C28BB404B"
},
{
"criteria": "cpe:2.3:a:elastic:x-pack:5.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "109A47C4-A688-4712-969F-08859B2A7923"
},
{
"criteria": "cpe:2.3:a:elastic:x-pack:5.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "761A9E6A-DBC5-48E4-8A79-A90F65C28E0F"
},
{
"criteria": "cpe:2.3:a:elastic:x-pack:5.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8BAAB65B-1C7C-4929-ACAA-9993E1626FF6"
},
{
"criteria": "cpe:2.3:a:elastic:x-pack:5.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BE9F72ED-C37A-435D-9253-801C97C50753"
},
{
"criteria": "cpe:2.3:a:elastic:x-pack:5.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "965A9F08-9C79-436D-98BA-DAC4F5D71EF7"
},
{
"criteria": "cpe:2.3:a:elastic:x-pack:5.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "86D9F09D-81BD-4B6E-8016-E6EAF2D68E5D"
}
],
"operator": "OR"
}
]
}
]