|
Vulnerabilities
< Back

CVE-2025-37731

Updated on 15 Dec 2025

Severity

7.4 High severity

Details

CVSS score
7.4
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

Details

Affected product:
Elasticsearch , Spring , elasticsearch , wildfly
Affected packages:
aggs-matrix-stats-client @ 7.9.3 (+1038 more)
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.