CVE-2024-23451: elasticsearch

csirt@kutim:~/threat-intel/cve/CVE-2024-23451

CVSS 6.5 · Medium EPSS 0,49%

Kerentanan Incorrect Authorization pada elasticsearch. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote cluster, and only if they use the Elasticsearch custom transport protocol to issue requests with the target index ID, the shard ID and the document ID. None of Elasticsearch REST API endpoints are affected by this issue.

Rincian

Terbit di NVD: 27 Maret 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-863: Incorrect Authorization
EPSS (30 hari): 0,49% peluang dieksploitasi; lebih tinggi dari 40,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
elastic	elasticsearch	Versi 8.10.0 hingga sebelum 8.13.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://discuss.elastic.co/t/elasticsearch-8-13-0-security-update-esa-2024-07/356315 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.