CVE-2018-17244

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a user to access information that they should not have access to.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-362 CWE-200

Affected software

Vendor	Product	Versions
Elastic	Elasticsearch	6.4.0 to 6.4.2

References

http://www.securityfocus.com/bid/106318Third Party Advisory, VDB Entry
https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594Vendor Advisory
https://www.elastic.co/community/securityVendor Advisory
http://www.securityfocus.com/bid/106318Third Party Advisory, VDB Entry
https://discuss.elastic.co/t/elastic-stack-6-4-3-and-5-6-13-security-update/155594Vendor Advisory
https://www.elastic.co/community/securityVendor Advisory

Timeline

Published: Dec 20, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-172459.8Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are used when generating P CVE-2018-172469.8Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kiban CVE-2018-172475.9Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing exte CVE-2018-17252.3IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440.CVE-2018-172549.8The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.CVE-2018-172564.8Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the CVE-2018-17279.1IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XM CVE-2018-17285.4IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2018-172817.5There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x CVE-2018-172826.5An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.CVE-2018-172837.5Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /opu CVE-2018-172874.9In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but th