CVE-2019-7611 (High) detected in elasticsearch-2.3.1.jar

[mend-for-github-com]

CVE-2019-7611 - High Severity Vulnerability

Vulnerable Library - elasticsearch-2.3.1.jar

Elasticsearch - Open Source, Distributed, RESTful Search Engine

Path to dependency file: Resiliency-Studio/resiliency-studio-service/pom.xml

Path to vulnerable library: ory/org/elasticsearch/elasticsearch/2.3.1/elasticsearch-2.3.1.jar

Dependency Hierarchy:

• ❌ elasticsearch-2.3.1.jar (Vulnerable Library)

Found in HEAD commit: 9809d9b7bfdc114eafb0a14d86667f3a76a014e8

Found in base branch: master

Vulnerability Details

A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index.

Publish Date: 2019-03-25

URL: CVE-2019-7611

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7611

Release Date: 2019-03-25

Fix Resolution: 5.6.15,6.6.1

---

⛑️ Automatic Remediation is available for this issue