Description
Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote cluster(s).
Remediation
References
https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_3
https://search-guard.com/cve-advisory/
Related Vulnerabilities
CVE-2020-16040 Vulnerability in npm package electron
CVE-2021-41182 Vulnerability in maven package org.webjars:jquery-ui
CVE-2023-29509 Vulnerability in maven package org.xwiki.platform:xwiki-platform-flamingo-theme-ui
CVE-2023-36542 Vulnerability in maven package org.apache.nifi:nifi-hbase_2-client-service
CVE-2020-2219 Vulnerability in maven package org.jenkins-ci.plugins:link-column