description: A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
problem types: CWE-264
affected:
{
product: elasticsearch
vendor: Elastic
versions:
status: affected, version: Versions 7.16.0 through 7.17.0
}