Description (CNA)
In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signals watch, the DLS rule is not enforced, allowing access to all documents in the queried indices.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| floragunn / Search Guard FLX | affected 1.0.0 through 3.1.2 |
CWE
CWE-200, CWE-863
References
- https://search-guard.com/cve-advisory/
- https://docs.search-guard.com/latest/changelog-searchguard-flx-3_1_3
- https://docs.search-guard.com/latest/changelog-searchguard-flx-4_0_0
ADP enrichment
No English description supplied.
No references supplied.