CVSS 3.0
6.5 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2018-17244
Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a user to access information that they should not have access to.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-200, CWE-362
- Published
- Modified
- Record from
- the NVD, synced
Affected
- elastic:elasticsearch
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vpqm-88c4-x4cv | Maven | org.elasticsearch:elasticsearch | >=6.4.0 <6.4.3 | 6.4.3 |