CVE-2019-13417

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user when field level security (FLS) is activated.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Aug 12, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-134187.5Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized.CVE-2019-134197.5Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked.CVE-2019-13427.8An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash, aka 'Windows Error RCVE-2019-134205.9Search Guard versions before 21.0 had an timing side channel issue when using the internal user database.CVE-2019-134214.9Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configuCVE-2019-134226.1Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially CVE-2019-134238.8Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kCVE-2019-13436.5A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. TCVE-2019-13445.5An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory, aka 'Windows CodCVE-2019-134459.8An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. parseOptions() in CVE-2019-134479.8An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could access tCVE-2019-134486.1An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could exploit
CVE-2019-13417: Medium severity, CVSS 5.3 | Vulnix