CyberRota Analysis
AI-GeneratedThe Elasticsearch custom inference service is vulnerable due to a missing authorization flaw, allowing users with limited inference execution privileges to redirect outbound inference traffic to unauthorized destinations. This could lead to the exposure of sensitive administrator-provisioned credentials, resulting in potential information disclosure. Organizations using Elasticsearch should prioritize addressing this vulnerability to mitigate risks associated with privilege abuse.
Original NVD Description
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.
Related CVEs
Other vulnerabilities affecting the same vendor(s)