QwikSec

Security Database

CVE

CWE

Training

CVE-2022-23708

Published: Mar 3, 2022

Modified: Aug 3, 2024

PUBLISHED

Description

A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.

Vendor	Product	Versions
Elastic	elasticsearch	affected `Versions 7.16.0 through 7.17.0`

Weaknesses (CWE)

References

https://discuss.elastic.co/t/elastic-stack-7-17-1-security-update/298447

x_refsource_MISC

https://security.netapp.com/advisory/ntap-20220729-0003/

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.