CVE-2017-8448 | BDVDB-2026-91005 Detail

ElasticElastic X-Pack Alerting

Description#

An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that results in that user gaining elevated privileges.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-284 Improper Access Control

References#

https://discuss.elastic.co/t/x-pack-alerting-and-kibana-5-6-1-security-update/101884

Exploit#

No public exploit known

History#

Version 12017-09-28Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.