CVE Vulnerability Catalog

Elasticsearch contains an incorrect authorization vulnerability in a configurable, non-default privilege that allows an administrator to delegate limited role-management capability. Due to incomplete enforcement of scope, a user with this privilege can expand their access to indices that should remain restricted, including internal security data.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains this weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a crafted request containing deeply nested aggregation definitions, triggering unbounded recursive execution that exhausts the server process's resources and causes the affected node to terminate. The node does not recover automatically and requires manual intervention.

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available heap memory and crashing the affected node.

Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, degrading or disabling Elastic Defend's real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists.

Incorrect authorization in Kibana can lead to disclosure of sensitive information. An authenticated user with limited Fleet privileges could access credential material restricted to Fleet administrators. Exploitation may allow theft of cryptographic keys and impersonation of trusted Fleet infrastructure components.

Elasticsearch does not limit total memory used when retrieving multiple index templates, despite per-resource limits. A user with manage_index_templates privilege can register many templates, and retrieving them together exhausts heap memory, causing node failure and denial of service.

Missing authorization in Kibana's Metrics Experience feature allows a user with only data-store-level read access to retrieve index-derived metric data through Kibana, despite lacking the corresponding Kibana feature privilege. A related API enforced authorization, but this internal API did not.

Uncontrolled recursion in Elasticsearch allows an authenticated low-privileged user to terminate an Elasticsearch node, resulting in denial of service. The vulnerability is related to excessive resource allocation.

Inefficient regular expression complexity in Elasticsearch's ES|QL CHUNK function can lead to denial of service via catastrophic backtracking. A user with read access to a text-based index can submit a crafted regex causing excessive CPU consumption and degrading query throughput for other tenants.

Incorrect authorization in Elasticsearch allows an authenticated user with privileges over a single resource to modify a data stream they are not authorized for. This can allow data injection or affect searchability, but does not enable reading the stream's contents.

Kibana contains an authorization bypass vulnerability in the Fleet package installation process. A user with delegated Fleet package-management privileges can claim a data stream identifier already in use by another tenant, redirecting the victim's data to infrastructure controlled by the attacker.

Uncontrolled resource consumption in Elasticsearch allows a low-privileged user to crash a node with a crafted query causing uncontrolled memory growth. The condition can be triggered repeatedly, including via queries in shared resources, causing persistent cluster unavailability.

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client can crash the portal service with a crafted HTTP request. The service restarts automatically, but a sustained low-rate attack can cause persistent denial of service. Remote code execution is not possible.

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client can crash the portal service with a crafted HTTP request. This results in temporary denial of service until the service restarts automatically. Remote code execution is not possible.

Arista Wi-Fi access points contain a memory corruption vulnerability in the wired uplink network endpoints. An unauthenticated attacker on the same network segment can crash the sensor service or potentially achieve remote code execution.

Arista Wi-Fi access points contain a vulnerability in the capture service. An unauthenticated attacker with network access can send a crafted packet to crash the service or potentially achieve remote code execution. This requires an uncommon non-default streaming mode.

On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible.

Arista access points with WIPS active contain a vulnerability that allows an unauthenticated attacker within RF proximity to send a crafted frame to crash the sensor service, disabling WIPS monitoring, or potentially achieve remote code execution. No wireless association or authentication is required.

Arista Wi-Fi access points with captive portal or application firewall enabled on at least one SSID contain a vulnerability in the wireless gateway service. An unauthenticated network-adjacent attacker can send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device.

An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.