CVE-2017-8446

MEDIUM

Elasticsearch X-pack < 5.5.1 - Insufficiently Protected Credentials

Title source: rule

Description

The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reporting_user role could execute a report with the permissions of another reporting user, possibly gaining access to sensitive data.

References (1)

[Vendor Advisory] https://www.elastic.co/community/security

Scores

CVSS v3 5.3

EPSS 0.0014

EPSS Percentile 34.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Classification

CWE

CWE-269 CWE-522

Status draft

Affected Products (3)

elasticsearch/x-pack < 5.5.1

elasticsearch/x-pack_reporting < 2.4.5

org.elasticsearch.plugin/x-pack < 5.5.2Maven

Timeline

Published Aug 18, 2017

Tracked Since Feb 18, 2026