CVE-2019-7611: elastic elasticsearch Improper Access Control
Vulnerability summary
CVE-2019-7611 is a high (CVSS 8.1) Improper Access Control vulnerability in elastic elasticsearch. EPSS estimates a 2.15% chance of exploitation in the next 30 days, higher than 81.9% of scored vulnerabilities.
Timeline
- 25-03-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.15%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.15% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Elastic1 product
- elasticsearch< 5.6.15 and 6.6.1 | < 5.6.15 | ≥ 6.0.0, < 6.6.1
Org.elasticsearch1 product
- elasticsearch< 5.6.15 | ≥ 6.0.0, < 6.6.1
2 vendors · 2 products
References
4 links- discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077X Refsource MISCWEBVendor Advisory
