« Volver al listado

CVE-2017-8448

Estado: ModificadaAlta (8.8)—

An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that results in that user gaining elevated privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Elastic — X-pack

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-8448",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@elastic.co",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Elastic X-Pack Alerting",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.0 to 5.6.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-29T01:34:50.607",
  "references": [
    {
      "url": "https://discuss.elastic.co/t/x-pack-alerting-and-kibana-5-6-1-security-update/101884",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security@elastic.co"
    },
    {
      "url": "https://discuss.elastic.co/t/x-pack-alerting-and-kibana-5-6-1-security-update/101884",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@elastic.co",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that results in that user gaining elevated privileges."
    },
    {
      "lang": "es",
      "value": "Existe un error en el modelo de permisos utilizado en X-Pack Alerting desde la versión 5.0.0 hasta la 5.6.0, en donde los usuarios que tienen integrados ciertos roles podrían crear un \"watch\" que haría que esos usuarios obtengan privilegios elevados."
    }
  ],
  "lastModified": "2026-06-17T01:26:23.137",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C15893C0-5FFF-4A60-940F-C69EBF60CE62"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFE40EC5-19CF-4DDC-98CF-DEA035CBBDED"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F2ABFD3F-65B8-45CA-8AA0-DD9FC0E668E5"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "444B1E15-1BEF-479B-8DEA-1DB5ACE7C051"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF9945D4-5B3B-41B3-9F94-DB11A8F7E262"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C26D394C-DE12-489F-B7E1-DF4C28BB404B"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "109A47C4-A688-4712-969F-08859B2A7923"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "761A9E6A-DBC5-48E4-8A79-A90F65C28E0F"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8BAAB65B-1C7C-4929-ACAA-9993E1626FF6"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE9F72ED-C37A-435D-9253-801C97C50753"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "965A9F08-9C79-436D-98BA-DAC4F5D71EF7"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86D9F09D-81BD-4B6E-8016-E6EAF2D68E5D"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BAF02F57-1183-4A26-98ED-90D43C8E1472"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F38E001E-D799-4F5E-BF62-E8F58EF7B8BE"
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE2E2D75-D5F8-4D62-B63E-595A8C280CFC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@elastic.co"
}