CVE-2024-23447

The CVE-2024-23447 entry relates to Elastic Network Drive Connector and the Windows Network Drive Connector, where a misconfiguration of Document Level Security (explicit allow write and deny read) allows a user to see a document in search results even though it is not accessible in the network d...

CVE-2024-23447 Elastic Network Drive Connector Improper Access Control

An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write and deny read. Although the document is not accessible to the user in Network Drive it is visible in search applications to the user...

CVE-2024-23447 Elastic Network Drive Connector Improper Access Control

An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write and deny read. Although the document is not accessible to the user in Network Drive it is visible in search applications to the user...

CVE-2024-23446

CVE-2024-23446 pertains to Kibana’s Detection Engine Search API failing to enforce Document-level security (DLS) and Field-level security (FLS) on .alerts-security.alerts-{space_id} indices. The issue allows users with API access and DLS/FLS-enabled roles to potentially read unauthorized document...

CVE-2024-23446 Kibana Broken Access Control issue

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security DLS or Field-level security FLS when querying the .alerts-security.alerts-spaceid indices. Users who are authorized to call this API may obtain unauthorized access to documents if...

CVE-2024-23446 Kibana Broken Access Control issue

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security DLS or Field-level security FLS when querying the .alerts-security.alerts-spaceid indices. Users who are authorized to call this API may obtain unauthorized access to documents if...

CVE-2024-23447: Improper Access Control

An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write and deny read. Although the document is not accessible to the user in Network Drive it is visible in search applications to the user...

CVE-2024-23446: Improper Access Control

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security DLS or Field-level security FLS when querying the .alerts-security.alerts-spaceid indices. Users who are authorized to call this API may obtain unauthorized access to documents if...

Elastic Network Drive Connector 8.12.1 Security Update (ESA-2024-02)

Elastic Network Drive Connector Improper Access Control ESA-2024-02 An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write and deny read. Although the document is not accessible to the user in...

PT-2024-1691 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana affected versions not specified Description: The issue is related to insufficient access control in the Kibana data visualization service. It allows a remote attacker to impact the confidentiality of protected information. Specifically...

PT-2024-19875 · Microsoft · Windows Network Drive Connector

Name of the Vulnerable Software and Affected Versions: Windows Network Drive Connector affected versions not specified Description: An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write and deny...

CVE-2023-46666

An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have read permissions to all content on the...

Code injection

An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have read permissions to all content on the...

CVE-2023-46666 Elastic Sharepoint Online Python Connector Improper Access Control

An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have read permissions to all content on the...

CVE-2023-46666 Elastic Sharepoint Online Python Connector Improper Access Control

An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have read permissions to all content on the...

CVE-2023-46666

Summary: CVE-2023-46666 affects Elastic Sharepoint Online Python Connector. The issue arises when using Document Level Security with the SPO “Limited Access” feature: a user granted limited access to a single item could read all content on the SharePoint site through Elasticsearch. Affected compo...

PT-2023-30150 · Elastic · Sharepoint Online Python Connector

Name of the Vulnerable Software and Affected Versions: Elastic Sharepoint Online Python Connector affected versions not specified Description: An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a...

CVE-2023-46666: Improper Access Control

An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have read permissions to all content on the...

Elasticsearch Security Vulnerabilities

Elasticsearch is a search engine based on the Lucene library. A security vulnerability exists in Elasticsearch that stems from the use of document-level security and the SPO "Limited Access" feature in the Elastic Sharepoint Online Python connector, where a user assigned limited access to an item...

Elastic Sharepoint Online Python Connector v8.10.3.0 Security Update

Elastic Sharepoint Online Python Connector Improper Access Control ESA-2023-18 An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a...