Improper access control in Elasticsearch - CVE-2019-7611
Published: March 27, 2019
Vulnerability identifier: #VU18086
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-7611
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.
The vulnerability exists due to improper access restrictions when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used, which means that elasticsearch.yml file has xpack.security.dls_fls.enabled set to false. A remote authenticated attacker can make API calls to the _aliases, _shrink, or _split endpoints and make existing data available under a new index/alias name.
Affected software
Elasticsearch
Arch Linux
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Junos Space Security Director
Arch Linux
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Junos Space Security Director
How to mitigate CVE-2019-7611
Install updates from vendor's website.
Elasticsearch - addressed in versions 5.6.15, 6.6.1
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.7.0
Junos Space Security Director - update to 24.1R3
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.7.0
Junos Space Security Director - update to 24.1R3