CVE-2022-23708
CVE-2022-23708
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
03 Mar 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
Affected products
Elastic · elasticsearchWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →