CVE-2019-7611 (High) detected in elasticsearch-6.4.2.jar, elasticsearch-5.6.10.jar

[mend-for-github-com]

CVE-2019-7611 - High Severity Vulnerability

Vulnerable Libraries - elasticsearch-6.4.2.jar, elasticsearch-5.6.10.jar

elasticsearch-6.4.2.jar

Elasticsearch subproject :server

Library home page: https://github.com/elastic/elasticsearch

Path to dependency file: cloud-pipeline/billing-report-agent/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.elasticsearch/elasticsearch/6.4.2/29a4003b7e28ae8d8896041e2e16caa7c4272ee3/elasticsearch-6.4.2.jar,canner/.gradle/caches/modules-2/files-2.1/org.elasticsearch/elasticsearch/6.4.2/29a4003b7e28ae8d8896041e2e16caa7c4272ee3/elasticsearch-6.4.2.jar

Dependency Hierarchy:

• ❌ elasticsearch-6.4.2.jar (Vulnerable Library)

elasticsearch-5.6.10.jar

Elasticsearch subproject :core

Library home page: https://github.com/elastic/elasticsearch

Path to dependency file: cloud-pipeline/api/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.elasticsearch/elasticsearch/5.6.10/ab7febde50a92702bbbba83db69acd75bda4b25/elasticsearch-5.6.10.jar

Dependency Hierarchy:

• transport-5.6.10.jar (Root Library)
  • ❌ elasticsearch-5.6.10.jar (Vulnerable Library)

Found in HEAD commit: 1db3170e0bd699acd5fec6e3fcebfa68fe86edcf

Found in base branch: develop

Vulnerability Details

A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index.

Publish Date: 2019-03-25

URL: CVE-2019-7611

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7611

Release Date: 2019-03-25

Fix Resolution: 5.6.15,6.6.1