CVE-2024-23449 MEDIUM

CVE-2024-23449: Elasticsearch Uncaught Exception

Vendor Elastic
Product Elasticsearch
Weakness CWE-248
Published March 29, 2024
Last update August 12, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

Key dates

02Disclosure timeline

March 29, 2024 CVE published
August 12, 2024 Record updated