CVE-2017-14730

Published: Sep 25, 2017Modified: May 13, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to a $LS_USER account for creation of a hard link.

Affected (17)

Products: Elasticsearch: Logstash

Elasticsearch

1 product

Logstash

Configuration A

17 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elasticsearch Logstash	Version 5.0.0
Elasticsearch Logstash	Version 5.0.1
Elasticsearch Logstash	Version 5.0.2
Elasticsearch Logstash	Version 5.1.1
Elasticsearch Logstash	Version 5.1.2
Elasticsearch Logstash	Version 5.2.0
Elasticsearch Logstash	Version 5.2.1
Elasticsearch Logstash	Version 5.3.0
Elasticsearch Logstash	Version 5.3.1
Elasticsearch Logstash	Version 5.3.2
Elasticsearch Logstash	Version 5.4.1
Elasticsearch Logstash	Version 5.4.2
Elasticsearch Logstash	Version 5.4.3
Elasticsearch Logstash	Version 5.5.0
Elasticsearch Logstash	Version 5.5.1
Elasticsearch Logstash	Version 5.5.2
Elasticsearch Logstash	Version 5.6.0