CVE-2023-31419
Published: 26 October 2023
Summary
CVE-2023-31419 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Elastic Elasticsearch. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 2.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A flaw was discovered in Elasticsearch affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. The issue is tracked under CVE-2023-31419 with a CVSS 3.1 score of 6.5 and is associated with CWE-121 and CWE-787.
An attacker with low privileges can send a malicious query over the network to trigger the stack overflow condition, resulting in a denial of service that affects availability while leaving confidentiality and integrity intact.
Elastic has released security updates in Elasticsearch versions 8.9.1 and 7.17.13 to address the vulnerability, as noted in their community security advisory and related NetApp notices recommending customers apply the patches.
The associated EPSS score reached a peak of 0.3921 with a current value of 0.3513.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2797
Vulnerability details
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.