CVE-2022-23712

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-754

Affected software

No affected versions have been published.

Timeline

Published: Jun 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-237136.1A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be CVE-2022-237147.8A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which CVE-2022-237156.5A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearc CVE-2022-237165.3A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in d CVE-2022-237175.5PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security CVE-2022-237188.1PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving CVE-2022-237196.4PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An at CVE-2022-23724.8The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2022-237208.2PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties fi CVE-2022-237213.3PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two peopl CVE-2022-237226.5When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID o CVE-2022-237237.7An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authen