Read the docs
TI-2019-10084 Aliases CVE-2019-13415GHSA-h875-c9g6-3qqq

Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was…

Priority LOW 31CWE-280Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not authorized to see.

Why it matters now

EPSS 0.00987 62nd percentileScored 2026-11-07
Fix Partial Search Guard (floragunn): 24.3Red Hat: 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
floragunnSearch Guardbefore 24.324.3Patch availableCNA
  • Search Guard Vendorfloragunn Affected before 24.3 Fixed in 24.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:search-guard:search_guard:*:*:*:*:*:*:*:*before 24.3Vulnerablefloragunn
  • cpe:2.3:a:search-guard:search_guard:*:*:*:*:*:*:*:* Versions before 24.3 Vulnerable ·floragunn

Remediation

  • Fix · CNA Search Guard (floragunn) Fixed in 24.3

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.10AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 3.9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-13415
  2. 2026-10-03 Alias added: GHSA-h875-c9g6-3qqq

References

Advisory 2

  • TI-2019-10092 Improper authentication in floragunn Search Guard Kibana Plugin CVSS 3.1HIGH 8.8
  • TI-2019-10088 Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. CVSS 3.0HIGH 7.5
  • TI-2019-10087 Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. CVSS 3.1HIGH 7.5
  • TI-2019-10085 Improper authorization in floragunn Search Guard CVSS 3.1MEDIUM 6.5
  • TI-2019-10091 Open redirect in floragunn Search Guard Kibana Plugin CVSS 3.0MEDIUM 6.1
  • TI-2019-10089 Search Guard versions before 21.0 had an timing side channel issue when using the internal user database. CVSS 3.1MEDIUM 5.9
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences