Authorization Flaw in Elastic Cloud Enterprise Affects User Roles
CVE-2018-3829

5.3MEDIUM

Key Information:

Vendor
Elastic
Status
Elastic Cloud Enterprise
Vendor
CVE Published:
19 September 2018

Summary

In Elastic Cloud Enterprise versions prior to 1.1.4, an authorization flaw allows users to extend allocators on new hosts with an invalid roles token. Attackers possessing the previous runner ID and the IP address of the coordinator-host can exploit this vulnerability to attach an allocator to an existing Elastic Cloud Enterprise installation, potentially gaining unauthorized access to data across clusters.

Affected Version(s)

Elastic Cloud Enterprise before 1.1.4

References

https://www.elastic.co/community/security
x_refsource_CONFIRM
https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.