CVE-2024-23447

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write and deny read. Although the document is not accessible to the user in Network Drive it is visible in search applications to the user.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Elastic	Elastic Network Drive Connector	>= 8.11.0, < 8.12.1

References

https://discuss.elastic.co/t/elastic-network-drive-connector-8-12-1-security-update-esa-2024-02/352687Vendor Advisory
https://www.elastic.co/community/securityVendor Advisory
https://discuss.elastic.co/t/elastic-network-drive-connector-8-12-1-security-update-esa-2024-02/352687Vendor Advisory
https://www.elastic.co/community/securityVendor Advisory

Timeline

Published: Feb 7, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-234487.5An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document fai CVE-2024-234495.3An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the R CVE-2024-23455.4The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fold CVE-2024-234507.5A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsea CVE-2024-234516.5Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elastic CVE-2024-234527.5Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerabilit CVE-2024-234535.5Android Spoon application version 7.11.1 to 8.6.0 uses hard-coded credentials, which may allow a local attacker to retrieve the hard-coded A CVE-2024-234546.2Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, al CVE-2024-234567.5Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with CVE-2024-234577.8The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enfo CVE-2024-234587.8While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading CVE-2024-234599.8An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to b