CVE-2019-13416

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote cluster(s).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-285

Affected software

Vendor	Product	Versions
floragunn	Search Guard	before 24.3

References

https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_3Release Notes, Vendor Advisory
https://search-guard.com/cve-advisory/Vendor Advisory
https://docs.search-guard.com/6.x-25/changelog-searchguard-6-x-24_3Release Notes, Vendor Advisory
https://search-guard.com/cve-advisory/Vendor Advisory

Timeline

Published: Aug 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-134175.3Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not al CVE-2019-134187.5Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized.CVE-2019-134197.5Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked.CVE-2019-13427.8An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash, aka 'Windows Error R CVE-2019-134205.9Search Guard versions before 21.0 had an timing side channel issue when using the internal user database.CVE-2019-134214.9Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configu CVE-2019-134226.1Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially CVE-2019-134238.8Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as k CVE-2019-13436.5A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. T CVE-2019-13445.5An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory, aka 'Windows Cod CVE-2019-134459.8An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. parseOptions() in CVE-2019-134479.8An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could access t