CVE-2023-46673 MEDIUM

CVE-2023-46673

Vendor Elastic

Product Elasticsearch

Weakness CWE-755

Published November 22, 2023

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.

Key dates

02Disclosure timeline

November 22, 2023 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-46673 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/755.html

Related vulnerabilities

Identifiers

CVE CVE-2023-46673

CWE CWE-755

CVSS 6.5 / MEDIUM

Affected versions

Vendor Elastic

Product Elasticsearch

Affected ≥ 7.0.0 and < 7.17.14

Vendor Elastic

Product Elasticsearch

Affected ≥ 8.0.0 and < 8.10.3

CVE-2023-46673

01Description

02Disclosure timeline

03References

04Related CVE