CVE-2024-12539
Dec. 17, 2024, 9:15 p.m.
None
No Score
Description
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.
Product(s) Impacted
| Product | Versions |
|---|---|
| Elasticsearch |
|
Weaknesses
CWE-863
Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Tags
Date
- Published: Dec. 17, 2024, 9:15 p.m.
- Last Modified: Dec. 17, 2024, 9:15 p.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
bressers@elastic.co
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.