vulnerability
Elastic Elasticsearch: CVE-2023-46674: Deserialization of Untrusted Data
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 6 | (AV:L/AC:H/Au:M/C:P/I:C/A:C) | Dec 5, 2023 | May 13, 2025 | May 13, 2025 |
Severity
6
CVSS
(AV:L/AC:H/Au:M/C:P/I:C/A:C)
Published
Dec 5, 2023
Added
May 13, 2025
Modified
May 13, 2025
Description
An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.
Solution
elastic-elasticsearch-upgrade-latest
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.