"Resiliency Studio" is a self-service Resilience Validation Platform, which helps to identify failure points within a system, aids to engineer applications to be fault-tolerant with self-healing capabilities
Other
0
stars
0
forks
source link
CVE-2019-7611 (High) detected in elasticsearch-2.3.1.jar #312
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index.
CVE-2019-7611 - High Severity Vulnerability
Elasticsearch - Open Source, Distributed, RESTful Search Engine
Path to dependency file: Resiliency-Studio/resiliency-studio-service/pom.xml
Path to vulnerable library: ory/org/elasticsearch/elasticsearch/2.3.1/elasticsearch-2.3.1.jar
Dependency Hierarchy: - :x: **elasticsearch-2.3.1.jar** (Vulnerable Library)
Found in HEAD commit: 9809d9b7bfdc114eafb0a14d86667f3a76a014e8
Found in base branch: master
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index.
Publish Date: 2019-03-25
URL: CVE-2019-7611
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7611
Release Date: 2019-03-25
Fix Resolution: 5.6.15,6.6.1
:rescue_worker_helmet: Automatic Remediation is available for this issue