Description
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Elastic Elasticsearch
Default version status: unaffected
7.0.0 to ≤ 7.17.29affected8.0.0 to ≤ 8.19.7affected9.0.0 to ≤ 9.1.7affected9.2.0 to ≤ 9.2.1affected