CVE-2024-23449

MEDIUM

4.3

Description

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

CVE Details

CVSS v3.1 Score4.3

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published3/29/2024

Last Modified2/4/2025

Sourcenvd

Honeypot Sightings0

Affected Products

elastic:elasticsearch

Weaknesses (CWE)

CWE-248

References

https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458(security@elastic.co)

https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.