description: X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rules used a mix of grant and exclude rules when merging multiple rules with field level security rules for the same index.
problem types: CWE-732: Incorrect Permission Assignment for Critical Resource
affected:
{
product: Elastic X-Pack Security
vendor: Elastic
versions:
status: affected, version: before 5.3.0
}