Description

Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote cluster(s).

Remediation

References

https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_3

https://search-guard.com/cve-advisory/

Related Vulnerabilities

CVE-2021-4307 Vulnerability in maven package org.webjars.npm:baobab

CVE-2018-6874 Vulnerability in maven package org.webjars.npm:auth0-lock

CVE-2021-42697 Vulnerability in maven package com.typesafe.akka:akka-http-core

CVE-2019-1003085 Vulnerability in maven package org.jenkins-ci.plugins:zephyr-enterprise-test-management

CVE-2023-40343 Vulnerability in maven package io.jenkins.plugins:tuleap-oauth

Severity

High

Classification

CWE-285 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Release Notes Vendor Advisory