CVE-2023-31419

🗓️ 26 Oct 2023 17:06:14Reported by elasticType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 164 Views🌐 WEB

A flaw in Elasticsearch _search API causing Stack Overflow and Denial of Servic

Reporter	Title	Published	Views	Family All 31
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for October 2023	26 Mar 202504:03	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Elasticsearch affect watsonx.data	3 Sep 202421:02	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Elasticsearch affect watsonx.data	16 Sep 202417:08	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.13 addresses multiple security vulnerabilities.	31 Jul 202411:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable multiple Elasticsearch vulnerabilities.	5 Feb 202420:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to a denial of service CVE-2023-31419	11 Mar 202414:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in elasticsearch-7.10.2.jar	5 Sep 202421:54	–	ibm
0day.today	Elasticsearch 8.5.3 Stack Overflow Exploit	26 Sep 202300:00	–	zdt
0day.today	Elasticsearch - StackOverflow DoS Exploit	11 Feb 202400:00	–	zdt
Circl	CVE-2023-31419	20 Sep 202322:42	–	circl

NVD

Node

elastic elasticsearchRange7.0.0–7.17.12

elastic elasticsearchRange8.0.0–8.9.0

[
  {
    "defaultStatus": "unaffected",
    "product": "Elasticsearch",
    "vendor": "Elastic",
    "versions": [
      {
        "lessThan": "7.17.12",
        "status": "affected",
        "version": "7.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "8.9.0",
        "status": "affected",
        "version": "8.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
discuss	www.discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297
security	www.security.netapp.com/advisory/ntap-20231116-0010/
elastic	www.elastic.co/community/security

Parameter	Position	Path	Description	CWE
query	request body	*/_search	Crafted search query can trigger stack overflow/DoS via the _search API in Elasticsearch.	CWE-787, CWE-121
message	request body	*/_search	Crafted search query can trigger stack overflow/DoS via the _search API in Elasticsearch.	CWE-787, CWE-121

13 Feb 2025 17:16Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.16.5 - 7.5

EPSS0.39212