{"id":"CVE-2022-23708","published":"2022-03-03T21:48:14Z","modified":"2024-08-03T03:51:45Z","title":"A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would…","vendor":"Elastic","product":"elasticsearch","tier":"tail","description":{"text":"A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01035,"percentile":0.6376,"provenance":"source"},"cwes":[{"id":"CWE-264","name":null}],"references":[{"url":"https://discuss.elastic.co/t/elastic-stack-7-17-1-security-update/298447","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20220729-0003/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":12.8,"factors":[{"name":"EPSS percentile","points":12.75}]},"vendorSlug":"elastic","affectedVersions":[{"vendor":"Elastic","product":"elasticsearch","versions":["Versions 7.16.0 through 7.17.0"]}],"affected":[{"ecosystem":"Maven","package":"org.elasticsearch:elasticsearch","vulnerableRanges":[">=7.16.0, <7.17.1"],"patched":["7.17.1"],"from":["GHSA-pgq6-ccqj-hpqr"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1497","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2021-22137","published":"2021-05-13","fixed":"7.11.2","kev":false},{"cve":"CVE-2021-22144","published":"2021-07-26","fixed":"7.13.3","kev":false},{"cve":"CVE-2021-22147","published":"2021-09-15","fixed":"7.14.0","kev":false},{"cve":"CVE-2022-23708","published":"2022-03-03","fixed":"7.17.1","kev":false},{"cve":"CVE-2022-23712","published":"2022-06-06","fixed":"8.2.1","kev":false},{"cve":"CVE-2023-31418","published":"2023-10-26","fixed":"8.9.0","kev":false,"link":{"from":"CVE-2022-23708","to":"CVE-2023-31418","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.elasticsearch:elasticsearch","fromFixed":"7.17.1","toFixed":"7.17.13","daysApart":602}]}},{"cve":"CVE-2023-31419","published":"2023-10-26","fixed":"8.9.1","kev":false,"link":{"from":"CVE-2022-23708","to":"CVE-2023-31419","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.elasticsearch:elasticsearch","fromFixed":"7.17.1","toFixed":"7.17.13","daysApart":602}]}},{"cve":"CVE-2023-31417","published":"2023-10-26","fixed":"8.9.2","kev":false,"link":{"from":"CVE-2022-23708","to":"CVE-2023-31417","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.elasticsearch:elasticsearch","fromFixed":"7.17.1","toFixed":"7.17.13","daysApart":602}]}}],"package":"Maven:org.elasticsearch:elasticsearch"}}