CVE-2019-13416 Missing authorization in Search Guard
Authenticated users bypass remote cluster role restrictions in Search Guard when Cross Cluster Search is enabled, allowing unauthorized data access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-13416?
CVE-2019-13416 is a medium-severity missing authorization vulnerability in floragunn Search Guard, published on 13 Aug 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote cluster(s).
Weakness: CWE-285
Which versions are affected by CVE-2019-13416?
It affects 1 product.
Products include Search-Guard Search Guard.
How do I fix CVE-2019-13416?
No fix has been published for CVE-2019-13416 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-13416 being exploited?
There is no known exploitation of CVE-2019-13416 in the wild and no public exploit code.
Other vulnerabilities in floragunn Search Guard
- CVE-2019-13423 Auth bypass in Search Guard Kibana Plugin
- CVE-2019-13419 Information disclosure in Search Guard
- CVE-2019-13418 Information disclosure in Search Guard
- CVE-2019-13415 Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data
- CVE-2019-13422 Open redirect in Search Guard Kibana Plugin
Sources
Also known as GHSA-fgm5-wx7c-v696.