CVE-2018-17244

Name of the Vulnerable Software and Affected Versions Elasticsearch Security versions 6.4.0 to 6.4.2

Description The issue arises from an error in applying request headers to requests when using certain authentication realms, such as Active Directory, LDAP, Native, or File realms. If multiple requests for the same username are being authenticated at the same time, a request may receive headers intended for another request. This can lead to a situation where a request is executed under the wrong user, potentially allowing a user to access information they should not have access to.

Recommendations For Elasticsearch Security versions 6.4.0 to 6.4.2, consider disabling the concurrent authentication feature for the affected realms as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.