Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-52980
CVE-2024-52980:
Java vulnerability analysis and mitigation
Overview
A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them. The vulnerability was assigned CVE-2024-52980 and affects Elasticsearch versions 7.17.0 to 8.15.0 (Elastic Discussion).
Technical details
The vulnerability is classified as an Uncontrolled Resource Consumption issue (CWE-400) with a CVSS v3.1 score of 6.5 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The flaw specifically involves the innerForbidCircularReferences function of the PatternBank class, which can be exploited to cause recursive operations leading to a crash (NVD, Elastic Discussion).
Impact
When successfully exploited, this vulnerability can cause the Elasticsearch node to crash, resulting in a denial of service condition. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (Elastic Discussion).
Mitigation and workarounds
Users are recommended to upgrade to Elasticsearch version 8.15.1 or higher to address this vulnerability. For users unable to upgrade immediately, a temporary mitigation involves removing the Elasticsearch cluster privileges (specifically read_pipeline) from users (Elastic Discussion).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management