{"id":"CVE-2023-46673","published":"2023-11-22T09:27:10Z","modified":"2024-08-02T20:53:21Z","title":"It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an…","vendor":"Elastic","product":"Elasticsearch","tier":"tail","description":{"text":"It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.\n","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00844,"percentile":0.57823,"provenance":"source"},"cwes":[{"id":"CWE-755","name":"Improper Handling of Exceptional Conditions"}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708","tags":[]},{"url":"https://www.elastic.co/community/security","tags":[]}],"priority":{"score":16.1,"factors":[{"name":"EPSS percentile","points":11.56},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"elastic","affectedVersions":[{"vendor":"Elastic","product":"Elasticsearch","versions":[">= 7.0.0, < 7.17.14",">= 8.0.0, < 8.10.3"]}],"affected":[{"ecosystem":"Maven","package":"org.elasticsearch:elasticsearch","vulnerableRanges":[">=7.0.0, <7.17.14",">=8.0.0, <8.10.3"],"patched":["7.17.14","8.10.3"],"from":["GHSA-285m-vhfq-xx4h"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-2844","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2023-31418","published":"2023-10-26","fixed":"8.9.0","kev":false},{"cve":"CVE-2023-31419","published":"2023-10-26","fixed":"8.9.1","kev":false},{"cve":"CVE-2023-31417","published":"2023-10-26","fixed":"8.9.2","kev":false,"link":{"from":"CVE-2023-31417","to":"CVE-2023-46673","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.elasticsearch:elasticsearch","fromFixed":"8.9.2","toFixed":"8.10.3","daysApart":27},{"kind":"version-step","provenance":"source","package":"Maven:org.elasticsearch:elasticsearch","fromFixed":"7.17.13","toFixed":"7.17.14","daysApart":27}]}},{"cve":"CVE-2023-46673","published":"2023-11-22","fixed":"8.10.3","kev":false},{"cve":"CVE-2024-23449","published":"2024-03-29","fixed":"8.11.1","kev":false,"link":{"from":"CVE-2023-46673","to":"CVE-2024-23449","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.elasticsearch:elasticsearch","fromFixed":"8.10.3","toFixed":"8.11.1","daysApart":128}]}},{"cve":"CVE-2023-49921","published":"2024-07-26","fixed":"8.11.2","kev":false,"link":{"from":"CVE-2023-46673","to":"CVE-2023-49921","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.elasticsearch:elasticsearch","fromFixed":"7.17.14","toFixed":"7.17.16","daysApart":247}]}},{"cve":"CVE-2024-23444","published":"2024-07-31","fixed":"8.13.0","kev":false}],"package":"Maven:org.elasticsearch:elasticsearch"}}