What is CVE-2024-23451?

CVE-2024-23451 is a medium-severity vulnerability in Elastic Elasticsearch, classified under Incorrect Authorization. CVSS score: 4.4/10. Published 2024-03-27.

How severe is CVE-2024-23451?

Medium severity. CVSS v3 base score is 4.4 out of 10.

Auth bypass in Elastic Elasticsearch

CVE-2024-23451

Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote cluster, and only if they use the Elasticsearch custom transport protocol to issue requests with the target index ID, the shard ID and the document ID. None of Elasticsearch REST API endpoints are affected by this issue.

Vulnerability class: Broken Access Control

EPSS: 0.004 (35.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Elastic Elasticsearch — versions 8.10.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

security@elastic.co (Vendor Advisory)

Frequently asked questions

What is CVE-2024-23451?: CVE-2024-23451 is a medium-severity vulnerability in Elastic Elasticsearch, classified under Incorrect Authorization. CVSS score: 4.4/10. Published 2024-03-27.
How severe is CVE-2024-23451?: Medium severity. CVSS v3 base score is 4.4 out of 10.