CVE-2024-23450 Elasticsearch Uncontrolled Resource Consumption vulnerability

2024-03-2717:03:48

CWE-400

elastic

www.cve.org

cve-2024-23450

elasticsearch

uncontrolled resource consumption

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

5.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Elasticsearch",
    "vendor": "Elastic",
    "versions": [
      {
        "lessThan": "7.17.19",
        "status": "affected",
        "version": "7.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "8.13.0",
        "status": "affected",
        "version": "8.0.0",
        "versionType": "semver"
      }
    ]
  }
]