Search-Guard Search Guard
10 CVEs affecting Search-Guard Search Guard. Latest disclosed: 2019-08-23. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13423 | High | 8.8 | 2019-08-23 | Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user wh… |
CVE-2019-13419 | High | 7.5 | 2019-08-13 | Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. |
CVE-2019-13418 | High | 7.5 | 2019-08-12 | Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. |
CVE-2019-13416 | Medium | 6.5 | 2019-08-13 | Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster igno… |
CVE-2019-13415 | Medium | 6.5 | 2019-08-13 | Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not autho… |
CVE-2019-13422 | Medium | 6.1 | 2019-08-23 | Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon… |
CVE-2018-20698 | Medium | 6.1 | 2019-04-09 | The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login redirects on the login page when basePath is set. |
CVE-2019-13420 | Medium | 5.9 | 2019-08-13 | Search Guard versions before 21.0 had an timing side channel issue when using the internal user database. |
CVE-2019-13417 | Medium | 5.3 | 2019-08-12 | Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user… |
CVE-2019-13421 | Medium | 4.9 | 2019-08-23 | Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal… |