CVE-2025-37731
BaseFortify
Publication date: 2025-12-15
Last updated on: 2025-12-18
Assigner: Elastic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elastic | elasticsearch | From 7.0.0 (inc) to 7.17.29 (inc) |
| elastic | elasticsearch | From 8.0.0 (inc) to 8.19.8 (exc) |
| elastic | elasticsearch | From 9.0.0 (inc) to 9.1.8 (exc) |
| elastic | elasticsearch | From 9.2.0 (inc) to 9.2.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-37731 is an improper authentication vulnerability in the Elasticsearch PKI realm. It allows an attacker to impersonate users by using specially crafted client certificates. However, the attacker must have a malicious client certificate that is signed by a legitimate, trusted Certificate Authority to exploit this issue. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Elasticsearch to a fixed version: 8.19.8, 9.1.8, or 9.2.2. There are no workarounds available for users unable to upgrade. [1]
How can this vulnerability impact me? :
This vulnerability can lead to user impersonation, meaning an attacker could gain unauthorized access to Elasticsearch systems by presenting a crafted client certificate. This could compromise the confidentiality and integrity of data within Elasticsearch, potentially allowing unauthorized data access or manipulation. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.