CVE-2017-8446

MEDIUM

Elastic X-Pack Reporting < 5.5.2 and < 2.4.6 - Privilege Escalation via Reporting User Impersonation

Title source: llm
STIX 2.1

Description

The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reporting_user role could execute a report with the permissions of another reporting user, possibly gaining access to sensitive data.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://www.elastic.co/community/security

Scores

CVSS v3 5.3
EPSS 0.0014
EPSS Percentile 34.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-269 CWE-522
Status published
Products (4)
Elastic/Elastic X-Pack Reporting Before 5.5.2 and 2.4.6
elasticsearch/x-pack < 5.5.1
elasticsearch/x-pack_reporting < 2.4.5
org.elasticsearch.plugin/x-pack 0 - 5.5.2Maven
Published Aug 18, 2017
Tracked Since Feb 18, 2026