HIGH✓ PATCH🇬🇧 English

CVE-2022-23712

CVSS 7.5v3.1pub. 2022-06-06upd. 2024-11-21

A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  • Elastic Elasticsearch

    APP
    Elastic
    8.0.0 – 8.2.1 (bez)
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
Tagi
Auth BypassDoS
CWE
Referencje

Powiązane podatności

CVE-2015-1427CRITICAL9.8⚠ KEVPL ✓ten sam produkt

Elasticsearch: ucieczka z sandboksa Groovy i zdalne wykonanie poleceń

CVE-2015-5377CRITICAL9.8PL ✓ten sam produkt

RCE w Elasticsearch przez protokół transportowy (przed wersją 1.6.1)

CVE-2014-3120HIGH8.1⚠ KEVten sam produkt

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers...

CVE-2026-72649HIGH8.8ten sam produkt

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote...

CVE-2026-72642HIGH8.8ten sam produkt

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a mo...