CVE-2017-8438 in X-Pack Security
Summary
Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specified user specified in a run_as request. If a role has been created using a template that contains the _user properties, the behavior of run_as will be incorrect. Additionally if the run_as user specified does not exist, the transition will not happen.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Reservation
05/02/2017
Disclosure
06/05/2017
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 101953 | Elastic X-Pack Security run_as privileges management | 269 | Not defined | Official fix | CVE-2017-8438 |