CVE Vulnerability Catalog

A vulnerability in Craft CMS where GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteId directly from arguments without passing through ArgumentManager::prepareArguments(), bypassing site-scope filtering. An attacker with a token scoped to Site A can create, modify, or delete entries in Site B.

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users' passwords if the attacker's account has 'Edit users' permission (which doesn't allow changing others' passwords) and lacks 'Administrate users' permission (which is required to change others' passwords).

Incorrect Authorization in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized data modification via Metadata Spoofing. An actor with limited Kubernetes permissions in a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.

Incorrect permission assignment for critical resources in Elastic Agent on Windows systems can lead to local privilege escalation. A local user can exploit overly broad access controls to execute arbitrary code and gain SYSTEM privileges.

Path Traversal vulnerability in Elastic Maps Server can lead to information disclosure. An unauthenticated attacker able to reach the service over the network could cause it to return contents of files outside its intended content directory that are readable by the server process.

Missing Authorization in Kibana for an Entity Store configuration operation allows an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices the user is not authorized to access. Derived entity data from those indices is then exposed through the entity store output.

Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster.

Path Traversal vulnerability in the Kibana Fleet feature can lead to unauthorized deletion of internal resources. A low-privileged user with Fleet write access could cause a subsequent administrative delete action to act on unintended internal resources. Exploitation requires an administrator to interact with the affected Fleet interface.

Incorrect Authorization in the Kibana machine learning feature can lead to information disclosure. An authenticated user with ML job management privileges in a single Kibana space could cause a job's saved object to become accessible across all spaces, without holding access rights to those additional spaces.

Improper handling of highly compressed data in APM Server can lead to persistent denial of service. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts memory when processed, terminating the process. The condition recurs on every restart until the stored content is removed.

Path Traversal vulnerability in the Kibana Fleet feature can lead to unauthorized deletion of resources. A low-privileged user could cause a subsequent action by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in deletion of resources including accounts with elevated privileges.

A path traversal vulnerability in the Kibana Fleet feature can lead to unauthorized deletion of privileged resources. A low-privileged user with Fleet Settings write access could cause administrative actions to affect unintended internal resources, such as user accounts.

Unrestricted resource allocation in Filebeat can lead to denial of service. An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the Filebeat process.

Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.

Unrestricted resource allocation in Kibana can lead to denial of service. An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, rendering it unavailable to all users.

Observable response discrepancy in the Kibana Osquery feature can lead to information disclosure. An authenticated user with Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.

The Restrict User Access WordPress plugin before version 2.8.1 does not normalize the REST API route before checking it against the routes covered by its content protection, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users.

The RegistrationMagic WordPress plugin before version 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants.

The RegistrationMagic WordPress plugin before version 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account.

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.