CVE-2022-23708: 
Java vulnerability analysis and mitigation

A flaw was discovered in Elasticsearch 7.17.0's upgrade assistant, affecting versions 7.16.0 through 7.17.0. The vulnerability emerges when upgrading from version 6.x to 7.x, where the process would disable the in-built protections on the security index (Elastic Discussion, CERT-FR).

The vulnerability has been assigned a CVSS v3 score of 6.8 (Medium) with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. The flaw specifically affects the security index protections during the version upgrade process, potentially exposing sensitive security configurations (Elastic Discussion).

When successfully exploited, this vulnerability allows authenticated users with '*' index permissions to gain access to the security index, potentially leading to disclosure of sensitive information and privilege escalation (Elastic Discussion, NetApp Security).

Users running affected clusters that were previously upgraded from 6.x should upgrade to version 7.17.1. For those planning to upgrade from 6.x, it is recommended to avoid versions 7.16 through 7.17.0 and instead use version 7.17.1 or later for the upgrade process (Elastic Discussion).