Authorization Flaw in Elastic Cloud Enterprise Affects User Roles
CVE-2018-3829
5.3MEDIUM
Summary
In Elastic Cloud Enterprise versions prior to 1.1.4, an authorization flaw allows users to extend allocators on new hosts with an invalid roles token. Attackers possessing the previous runner ID and the IP address of the coordinator-host can exploit this vulnerability to attach an allocator to an existing Elastic Cloud Enterprise installation, potentially gaining unauthorized access to data across clusters.
Affected Version(s)
Elastic Cloud Enterprise before 1.1.4
References
CVSS V3.1
Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved