CVE-2024-23451

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote cluster, and only if they use the Elasticsearch custom transport protocol to issue requests with the target index ID, the shard ID and the document ID. None of Elasticsearch REST API endpoints are affected by this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-234527.5Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerabilit CVE-2024-234535.5Android Spoon application version 7.11.1 to 8.6.0 uses hard-coded credentials, which may allow a local attacker to retrieve the hard-coded A CVE-2024-234546.2Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, al CVE-2024-234567.5Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with CVE-2024-234577.8The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enfo CVE-2024-234587.8While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading CVE-2024-234599.8An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Mac allows a system file to b CVE-2024-23465.4The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all CVE-2024-234607.8The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally CVE-2024-234615.5An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a Lo CVE-2024-234627.5An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client CVE-2024-234638.1Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality