CVE-2017-8448: High severity elastic vulnerability
Published Sep 28, 2017
·Updated
An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that results in that user gaining elevated privileges.
Affected Software
15 affected components
Elastic X-Pack=5.0.0
Elastic X-Pack=5.0.1
Elastic X-Pack=5.0.2
Elastic X-Pack=5.1.1
Elastic X-Pack=5.2.0
Elastic X-Pack=5.2.1
Elastic X-Pack=5.2.2
Elastic X-Pack=5.3.0
Elastic X-Pack=5.3.1
Elastic X-Pack=5.3.2
Elastic X-Pack=5.3.3
Elastic X-Pack=5.4.0
Elastic X-Pack=5.5.0
Elastic X-Pack=5.5.2
Elastic X-Pack=5.6.0
Event History
Sep 28, 2017
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-8448?
CVE-2017-8448 has a high severity rating due to the potential for users to gain elevated privileges.
2
How do I fix CVE-2017-8448?
To fix CVE-2017-8448, upgrade to a version of X-Pack Alerting that is higher than 5.6.0.
3
Which versions of Elastic X-Pack are affected by CVE-2017-8448?
CVE-2017-8448 affects Elastic X-Pack versions from 5.0.0 to 5.6.0.
4
What types of users are affected by CVE-2017-8448?
Users mapped to certain built-in roles may exploit CVE-2017-8448 to create a watch and escalate their privileges.
5
Is there a workaround for CVE-2017-8448?
There is no known workaround for CVE-2017-8448 other than applying the necessary software updates.