PT-2019-13327

Name of the Vulnerable Software and Affected Versions Search Guard versions prior to 24.3 Description The issue occurs when Cross Cluster Search CCS is enabled, allowing authenticated users to gain read access to data they are not authorized to see. Recommendations For versions prior to 24.3,...

floragunn Search Guard Input Validation Error Vulnerability

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , it mainly provides encryption , authentication , authorization management and log auditing and other functions . An input validation error vulnerability exists in versions prior to floragunn Sear...

PT-2019-13331

Name of the Vulnerable Software and Affected Versions Search Guard versions prior to 23.1 Description The issue affects aggregations where clear text values of anonymised fields were leaked. Recommendations For versions prior to 23.1, update to version 23.1 or later to resolve the issue...

PT-2019-13328

Name of the Vulnerable Software and Affected Versions Search Guard versions prior to 24.3 Description The issue occurs when Cross Cluster Search CCS is enabled, allowing authenticated users to be always authorized on the local cluster, ignoring their roles on the remote clusters. Recommendations...

PT-2019-8423

Name of the Vulnerable Software and Affected Versions Backup Guard plugin versions prior to 1.1.47 Description The issue concerns multiple XSS problems. Recommendations For versions prior to 1.1.47, update to version 1.1.47 or later to resolve the issue...

CVE-2019-13420: Observable Timing Discrepancy

Search Guard versions before 21.0 had an timing side channel issue when using the internal user database...

PT-2019-13332

Name of the Vulnerable Software and Affected Versions Search Guard versions prior to 21.0 Description The issue is related to a timing side channel problem that occurs when the internal user database is used. Recommendations For versions prior to 21.0, update to version 21.0 or later to resolve t...

CVE-2019-13419: Missing Encryption of Sensitive Data

Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked...

CVE-2019-13415: Improper Handling of Insufficient Permissions or Privileges

Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users can gain read access to data they are not authorized to see...

CVE-2017-18488: Improper Neutralization of Input During Web Page Generation

The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues...

CVE-2019-13418

Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized...

CVE-2019-13418

Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized...

Input validation

Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized...

CVE-2019-13417

Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names but not values for fields which are not allowed for the user when field level security FLS is activated...

Design/Logic Flaw

Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names but not values for fields which are not allowed for the user when field level security FLS is activated...

CVE-2019-13418

Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized...

CVE-2019-13418

CVE-2019-13418 concerns floragunn Search Guard (for Elasticsearch/ELK) prior to version 24.0, where string-array values in documents were not properly anonymized. The underlying issue affects confidentiality, as sensitive data could be exposed due to inadequate anonymization. Public references fr...

CVE-2019-13417

CVE-2019-13417 affects floragunn Search Guard (pre-24.0) where field caps and the mapping API leak field names (not values) for fields not allowed under Field Level Security (FLS). Impact is disclosure of metadata about restricted fields via these APIs, with no evidence of values exposed. The iss...

CVE-2019-13417

Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names but not values for fields which are not allowed for the user when field level security FLS is activated...

floragunn Search Guard Information Disclosure Vulnerability (CNVD-2019-44763)

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , it mainly provides encryption , authentication , authorization management and log auditing and other functions . floragunn Search Guard 24.0 before the version of the information leakage...