CVE-2023-46666
Medium
Description
An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have read permissions to all content on the Sharepoint site through Elasticsearch.
SeverityMedium
CVSS5.3
Exploit probability—
ProductElastic Sharepoint Online Python Connector
PublishedOct 26, 2023
First seenOct 26, 2023
Weakness typeCWE-284Improper access control
How to fix
Update
- elastic elastic_sharepoint_online_python_connector8.10.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elastic elastic_sharepoint_online_python_connector | v < 8.10.3.0 | 8.10.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.