CVE-2024-23449

MEDIUM

4.3

Description

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

Details CVE

Score CVSS v3.14.3

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurNONE

Publie3/29/2024

Derniere modification2/4/2025

Sourcenvd

Observations honeypot0

Produits affectes

elastic:elasticsearch

Faiblesses (CWE)

CWE-248

References

https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458(security@elastic.co)

https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.