Elastic Sharepoint Online Python Connector Improper Access Control (ESA-2023-18)
An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector.
If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have read permissions to all content on the Sharepoint site through Elasticsearch.
Affected Versions:
Elastic Sharepoint Online Python Connector Before v8.10.3.0
Solutions and Mitigations:
The issue is resolved in Elastic Sharepoint Online Python Connector v8.10.3.0 and above
CVSSv3: 5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE-2023-46666