CVE-2024-23446

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Feb 7, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-234476.5An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with expl CVE-2024-234487.5An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document fai CVE-2024-234495.3An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the R CVE-2024-23455.4The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fold CVE-2024-234507.5A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsea CVE-2024-234516.5Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elastic CVE-2024-234527.5Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerabilit CVE-2024-234535.5Android Spoon application version 7.11.1 to 8.6.0 uses hard-coded credentials, which may allow a local attacker to retrieve the hard-coded A CVE-2024-234546.2Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, al CVE-2024-234567.5Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with CVE-2024-234577.8The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enfo CVE-2024-234587.8While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading