CVE-2025-13653

{"id": "CVE-2025-13653", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13653", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-01T18:33:30.571650Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@search-guard.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@search-guard.com", "affectedData": [{"vendor": "floragunn", "product": "Search Guard FLX", "versions": [{"status": "affected", "version": "3.1.0", "versionType": "semver", "lessThanOrEqual": "4.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-01T18:16:02.707", "references": [{"url": "https://docs.search-guard.com/latest/changelog-searchguard-flx-4_0_1", "source": "security@search-guard.com"}, {"url": "https://search-guard.com/cve-advisory/", "source": "security@search-guard.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@search-guard.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use specially crafted requests to read documents from data streams without having the respective privileges."}, {"lang": "es", "value": "En las versiones de Search Guard FLX desde la 3.1.0 hasta la 4.0.0 con los m\u00f3dulos empresariales deshabilitados, existe un problema que permite a usuarios autenticados usar solicitudes especialmente dise\u00f1adas para leer documentos de flujos de datos sin tener los privilegios respectivos."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security@search-guard.com"}