CVE-2023-46674 Elasticsearch-hadoop Unsafe Deserialization

2023-12-0517:21:59

CWE-502

elastic

www.cve.org

cve-2023-46674

elasticsearch-hadoop

unsafe deserialization

authenticated users

amazon web services

6 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H

7.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Elasticsearch-Hadoop",
    "vendor": "Elastic",
    "versions": [
      {
        "lessThan": "7.17.11",
        "status": "affected",
        "version": "1.3.0",
        "versionType": "1.x.x"
      },
      {
        "lessThan": "8.9.0",
        "status": "affected",
        "version": "8.0.0",
        "versionType": "8.x.x"
      }
    ]
  }
]