CVE-2022-23708
Elasticsearch privilege escalation
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
- Record
CVE-2022-23708- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
- Record
CVE-2022-23708- Weakness
- CWE-264
- Updated
- 2026-11-02
EUVDEUVD-2022-1497 No score
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
- Record
EUVD-2022-1497- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pgq6-ccqj-hpqr
Elasticsearch privilege escalation
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index. Users running a cluster on an affected version that had previously been upgraded from 6.x, should upgrade to 7.17.1. Users that are planning to upgrade from 6.x should not perform an upgrade from 6.x to versions 7.16 through 7.17.0 and should use 7.17.1+ for upgrades from 6.x.
- Record
GHSA-pgq6-ccqj-hpqr- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-269
- Updated
- 2026-11-02
OSVGHSA-pgq6-ccqj-hpqr
Elasticsearch privilege escalation
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index. Users running a cluster on an affected version that had previously been upgraded from 6.x, should upgrade to 7.17.1. Users that are planning to upgrade from 6.x should not perform an upgrade from 6.x to versions 7.16 through 7.17.0 and should use 7.17.1+ for upgrades from 6.x.
- Record
GHSA-pgq6-ccqj-hpqr- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-269
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-23708
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
- Record
UBUNTU-CVE-2022-23708- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVBIT-elasticsearch-2022-23708 No score
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
- Record
BIT-elasticsearch-2022-23708- Updated
- 2026-11-02
OSV No score
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
- Record
CVE-2022-23708- Weakness
- CWE-264
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.elasticsearch:elasticsearchMaven |
7.16.0 up to 7.17.1 | 7.17.1 |
elasticsearchBitnami |
7.16.0 up to 7.17.1 | 7.17.1 |
org.elasticsearch:elasticsearchMaven |
7.16.0 up to 7.17.1, plus listed versions 7.16.17.16.27.16.37.17.0 |
7.17.1 |
elasticsearchUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.2+dfsg-11.7.3+dfsg-11.7.3+dfsg-21.7.3+dfsg-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-23708 is a medium vulnerability (CVSS 4.3) in Elastic Elasticsearch, published March 3, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 64th percentile. Fixed in org.elasticsearch:elasticsearch 7.17.1.
References
discuss.elastic.co/t/elastic-stack-7-17-1-security-update/298447
security.netapp.com/advisory/ntap-20220729-0003
nvd.nist.gov/vuln/detail/CVE-2022-23708
github.com/advisories/GHSA-pgq6-ccqj-hpqr
ubuntu.com/security/CVE-2022-23708
cve.org/CVERecord?id=CVE-2022-23708