Latest Elastic Vulnerabilities

Elastic Elasticsearch is vulnerable to a denial of service, caused by improper handling of exceptional conditions. By sending a specially crafted request using the Simulate Pipeline API, a remote auth...

maven/org.elasticsearch:elasticsearch>=8.0.0<8.10.3

maven/org.elasticsearch:elasticsearch>=7.0.0<7.17.14

Elastic Elasticsearch>=7.0.0<7.17.14

Elastic Elasticsearch>=8.0.0<8.10.3

● CVE-2021-37937

Elasticsearch privilege escalation

Elastic Elasticsearch>=7.13.0<=7.14.0

● CVE-2021-37942

APM Java Agent Local Privilege Escalation

maven/co.elastic.apm:apm-agent-parent>=1.18.0<1.27.1

Elastic Apm Java Agent>=1.18.0<=1.27.0

● CVE-2021-22142

Kibana Reporting vulnerabilities

Elastic Kibana>=7.0.0<7.13.0

● CVE-2021-22151

Kibana path traversal issue

Elastic Kibana>=7.9.0<=7.14.0

● CVE-2021-22150

Kibana code execution issue

Elastic Kibana>=7.10.2<7.14.1

● CVE-2023-46672

Logstash Insertion of Sensitive Information into Log File

Elastic Logstash>=8.10.0<8.11.1

Elastic Logstash=7.12.1

● CVE-2023-31416

Elastic Cloud on Kubernetes (ECK) secret token configuration issue

Elastic Elastic Cloud On Kubernetes<2.8

Elastic Apm Server>=8.0

● CVE-2023-31417

Elasticsearch Insertion of sensitive information in audit logs

>=7.0.0<=7.17.12

>=8.0.0<=8.9.1

Elastic Elasticsearch>=7.0.0<=7.17.12

Elastic Elasticsearch>=8.0.0<=8.9.1

maven/org.elasticsearch:elasticsearch>=8.0.0<8.9.2

maven/org.elasticsearch:elasticsearch>=7.0.0<7.17.13

● CVE-2023-31418

Elasticsearch uncontrolled resource consumption

Elastic Elasticsearch<=7.17.12

Elastic Elasticsearch>=8.0.0<=8.8.2

Elastic Elastic Cloud Enterprise<=2.13.3

Elastic Elastic Cloud Enterprise=3.6.0

maven/org.elasticsearch:elasticsearch>=8.0.0<8.9.0

maven/org.elasticsearch:elasticsearch<7.17.13

● CVE-2023-31419

Elasticsearch StackOverflow vulnerability

maven/org.elasticsearch:elasticsearch>=8.0.0<8.9.1

maven/org.elasticsearch:elasticsearch>=7.0.0<7.17.13

Elastic Elasticsearch>=7.0.0<=7.17.12

Elastic Elasticsearch>=8.0.0<=8.9.0

● CVE-2023-46666

Elastic Sharepoint Online Python Connector Improper Access Control

Elastic Elastic Sharepoint Online Python Connector<8.10.3.0

● CVE-2023-31421

Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue

Elastic Elastic Beats>=8.0.0<=8.9.2

Elastic Elastic Agent>=8.0.0<=8.9.2

Elastic Apm Server>=8.0.0<=8.9.2

Elastic Elastic Fleet Server>=8.0.0<=8.9.2

● CVE-2023-31422

Kibana Insertion of Sensitive Information into Log File

Elastic Kibana=8.10.0

● CVE-2023-46667

Fleet Server Insertion of Sensitive Information into Log File

Elastic Fleet Server>=8.10.0<8.10.3

● CVE-2023-46668

Elastic Endpoint Insertion of Sensitive Information into Log File

Elastic Endpoint>=7.9.0<=8.10.3

● CVE-2023-31413

Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to be leaked in the logs when debug logging i...

Elastic Filebeat<=7.17.9

Elastic Filebeat=8.6.2

● CVE-2023-31414

Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execut...

Elastic Kibana>=8.0.0<=8.7.0

● CVE-2023-31415

Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This...

Elastic Kibana=8.7.0

● CVE-2022-38779

An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.

Elastic Kibana>=7.0.0<7.17.9

Elastic Kibana>=8.0.0<8.6.2

● CVE-2022-38777

An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.

Elastic Endgame<3.62.3

Elastic Endpoint Security<7.17.9

Elastic Endpoint Security>=8.0.0<8.5.0

Microsoft Windows

● CVE-2022-38778

A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.

Decode-uri-component Project Decode-uri-component<0.2.1

Elastic Kibana>=7.0.0<7.17.9

Elastic Kibana>=8.0.0<8.6.1

● CVE-2022-38775

An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.

Elastic Endpoint Security<8.4.1

Microsoft Windows

● CVE-2022-38774

An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSy...

Elastic Endgame<=3.62.2

Elastic Endpoint Security<7.17.7

Elastic Endpoint Security>=8.0.0<8.4.0

Microsoft Windows

● CVE-2021-37936

It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inj...

Elastic Kibana<7.14.1

● CVE-2021-22141

An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary websit...

Elastic Kibana<6.8.16

Elastic Kibana>=7.0.0<7.13.0

● CVE-2022-23716

A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster.

Elastic Elastic Cloud Enterprise<3.1.1

● CVE-2022-23715

A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or ...

Elastic Elastic Cloud Enterprise<3.4.0

● CVE-2022-23714

A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges t...

Elastic Endpoint Security>=7.13.0<=7.17.4

Elastic Endpoint Security>=8.0.0<=8.2.3

Microsoft Windows

● CVE-2022-23713

A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser.

Elastic Kibana>=7.0.0<7.17.5

Elastic Kibana>=8.0.0<=8.2.3

● CVE-2022-23712

Elastic Elasticsearch>=8.0.0<8.2.1

● CVE-2022-23711

A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the healt...

Elastic Kibana>=7.2.1<7.17.3

Elastic Kibana>=8.0.0<8.1.3

● CVE-2022-23709

A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite ex...

Elastic Kibana>=7.7.0<7.17.1

Elastic Kibana=8.0.0

● CVE-2022-23710

A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s ...

Elastic Kibana>=7.15.0<=7.17.0

Elastic Kibana=8.0.0

● CVE-2022-23707

An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index patter...

Elastic Kibana>=7.5.1<7.17.0

● CVE-2021-37941

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a m...

Elastic Apm Agent>=1.10.0<=1.26.0

pip/elastic-apm>=1.10.0<1.27.0

● CVE-2021-37940

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integration. Using this vulnerability, a malicious...

Elastic Enterprise Search<7.16.0

● CVE-2021-37939

It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vu...

Elastic Kibana>=7.8.0<7.15.2

● CVE-2021-37938

It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily trave...

Elastic Kibana>=7.9.0<7.15.2

● CVE-2021-22149

Elastic Enterprise Search<7.14.0

● CVE-2021-22148

Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as their creator. This could lead to a less privileged user gai...

Elastic Enterprise Search<7.14.0

● CVE-2021-22147

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized t...

Elastic Elasticsearch>=7.11.0<7.14.0

Latest Elastic Vulnerabilities

Company

Resources

Contact