Read the docs
TI-2019-10086 Aliases CVE-2019-13417GHSA-m7rg-2hpc-fj28

Incorrect authorization in floragunn Search Guard

Priority LOW 26CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-863 and CWE-200.

Summary

Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user when field level security (FLS) is activated.

Why it matters now

EPSS 0.01104 65th percentileScored 2026-11-07
Fix Partial Search Guard (floragunn): 24.0Red Hat: 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
floragunnSearch Guardbefore 24.024.0Patch availableCNA
  • Search Guard Vendorfloragunn Affected before 24.0 Fixed in 24.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:search-guard:search_guard:*:*:*:*:*:*:*:*before 24.0Vulnerablefloragunn
  • cpe:2.3:a:search-guard:search_guard:*:*:*:*:*:*:*:* Versions before 24.0 Vulnerable ·floragunn

Remediation

  • Fix · CNA Search Guard (floragunn) Fixed in 24.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    floragunn Search Guard 24.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2019-10087 Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized.Priority LOW 35
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Not affected: 2 products
  • Red Hat OpenShift Container Platform 3.10
  • Red Hat OpenShift Container Platform 3.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-13417
  2. 2026-10-03 Alias added: GHSA-m7rg-2hpc-fj28

References

Advisory 1

Other 1

  • TI-2019-10092 Improper authentication in floragunn Search Guard Kibana Plugin CVSS 3.1HIGH 8.8
  • TI-2019-10088 Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. CVSS 3.0HIGH 7.5
  • TI-2019-10087 Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. CVSS 3.1HIGH 7.5
  • TI-2019-10085 Improper authorization in floragunn Search Guard CVSS 3.1MEDIUM 6.5
  • TI-2019-10084 Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was… CVSS 3.1MEDIUM 6.5
  • TI-2019-10091 Open redirect in floragunn Search Guard Kibana Plugin CVSS 3.0MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences