GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2017-8438

Vulnerability from fkie_nvd - Published: 2017-06-05 14:29 - Updated: 2026-06-17 01:26
Severity
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specified user specified in a run_as request. If a role has been created using a template that contains the _user properties, the behavior of run_as will be incorrect. Additionally if the run_as user specified does not exist, the transition will not happen.
References
security@elastic.cohttps://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952Vendor Advisory
security@elastic.cohttps://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-releasedPatch, Vendor Advisory
security@elastic.cohttps://www.elastic.co/community/securityVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-releasedPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.elastic.co/community/securityVendor Advisory
Impacted products
Vendor Product Version
elastic x-pack 5.0.0
elastic x-pack 5.0.1
elastic x-pack 5.0.2
elastic x-pack 5.1.0
elastic x-pack 5.1.1
elastic x-pack 5.2.0
elastic x-pack 5.2.1
elastic x-pack 5.2.2
elastic x-pack 5.3.0
elastic x-pack 5.3.1
elastic x-pack 5.3.2
elastic x-pack 5.3.3
elastic x-pack 5.4.0
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "X-Pack Security",
          "vendor": "Elastic",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.0 to 5.4.0"
            }
          ]
        }
      ],
      "source": "security@elastic.co"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C15893C0-5FFF-4A60-940F-C69EBF60CE62",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "BFE40EC5-19CF-4DDC-98CF-DEA035CBBDED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2ABFD3F-65B8-45CA-8AA0-DD9FC0E668E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "26C9B833-CFB8-4CC3-A28D-E5320276E5D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "444B1E15-1BEF-479B-8DEA-1DB5ACE7C051",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF9945D4-5B3B-41B3-9F94-DB11A8F7E262",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C26D394C-DE12-489F-B7E1-DF4C28BB404B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "109A47C4-A688-4712-969F-08859B2A7923",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "761A9E6A-DBC5-48E4-8A79-A90F65C28E0F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "8BAAB65B-1C7C-4929-ACAA-9993E1626FF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE9F72ED-C37A-435D-9253-801C97C50753",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "965A9F08-9C79-436D-98BA-DAC4F5D71EF7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:elastic:x-pack:5.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "86D9F09D-81BD-4B6E-8016-E6EAF2D68E5D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specified user specified in a run_as request. If a role has been created using a template that contains the _user properties, the behavior of run_as will be incorrect. Additionally if the run_as user specified does not exist, the transition will not happen."
    },
    {
      "lang": "es",
      "value": "Las versiones 5.0.0 hasta 5.4.0 de Elastic X-Pack Security contienen un error de escalaci\u00f3n de privilegios en la funcionalidad run_as. Este error impide la transici\u00f3n al usuario establecido, especificado en una petici\u00f3n de run_as. Si un rol ha sido creado utilizando una plantilla que contiene las propiedades de _user, el comportamiento de run_as ser\u00e1 incorrecto. Adem\u00e1s, si el usuario run_as especificado no existe, la transici\u00f3n no se pasar\u00e1."
    }
  ],
  "id": "CVE-2017-8438",
  "lastModified": "2026-06-17T01:26:22.100",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-06-05T14:29:00.280",
  "references": [
    {
      "source": "security@elastic.co",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952"
    },
    {
      "source": "security@elastic.co",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released"
    },
    {
      "source": "security@elastic.co",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.elastic.co/community/security"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.elastic.co/blog/elasticsearch-5-4-1-and-5-3-3-released"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.elastic.co/community/security"
    }
  ],
  "sourceIdentifier": "security@elastic.co",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "security@elastic.co",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.