-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.elasticsearch:elasticsearch | maven | >= 8.4.0, < 8.11.1 | 8.11.1 |
Miggo AIRoot Cause AnalysisThe vulnerability occurs in the attachment processor during PDF parsing. Since the issue is specific to encrypted (non-password-protected) PDF processing through the REST API, the root cause must be in the PDF parsing logic of the attachment processor. The AttachmentProcessor class in Elasticsearch's ingest-attachment module is responsible for document parsing using Apache Tika. The uncaught exception likely originates from Tika's decryption handling that isn't properly wrapped in try-catch blocks in the parse method. The high confidence comes from the vulnerability's specific context (attachment processing) and the CWE-248 classification indicating missing exception handling.