Description
Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.
Remediation
References
https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344
https://security.netapp.com/advisory/ntap-20211008-0002/
https://www.elastic.co/community/security/
Related Vulnerabilities
CVE-2023-46998 Vulnerability in maven package org.webjars.bower:bootbox.js
CVE-2023-30548 Vulnerability in npm package gatsby-plugin-sharp
CVE-2023-40338 Vulnerability in maven package org.jenkins-ci.plugins:cloudbees-folder
CVE-2022-34197 Vulnerability in maven package org.jenkins-ci.plugins:sauce-ondemand
CVE-2009-2902 Vulnerability in maven package org.apache.tomcat:catalina