What’s Vulnerable › Vulnerabilities

CVE-2017-8447

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-09-29 · updated 2026-06-17
• Weakness: CWE-284

Description

An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement. If a user has either 'delete' or 'index' permissions on an index in a cluster, they may be able to issue both delete and index requests against that index.

Affected products

• Elastic X-Pack Security: 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.4.0, 5.5.0 (+1)

References

• https://discuss.elastic.co/t/x-pack-security-5-6-0-and-5-5-3-security-update/100089
• https://discuss.elastic.co/t/x-pack-security-5-6-0-and-5-5-3-security-update/100089

Get alerted when CVE-2017-8447 or the next vulnerability affects your stack