The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reporting_user role could execute a report with the permissions of another reporting user, possibly gaining access to sensitive data.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.elasticsearch.plugin:x-pack(Maven) | 0 | 5.5.2 | N/A |
CVSS Metrics
