| Package | Affected versions | Patched versions |
|---|---|---|
| org.elasticsearch.plugin:x-pack | < 5.5.2 | 5.5.2 |
| x-pack | ≤ 5.5.1 | |
| x-pack reporting | ≤ 2.4.5 |
The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reporting_user role could execute a report with the permissions of another reporting user, possibly gaining access to sensitive data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free