GitHub Advisoryadvisory · Maven

GHSA-cqgv-256r-m9r8 Insertion of Sensitive Information into Log File in Elasticsearch

MEDIUM Published 2022-05-24 Modified 2022-06-23 Official page ↗
Aliases
CVE-2020-7021
Ecosystem
Maven
Packages
org.elasticsearch:elasticsearch
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2022-06-23

Affected packages

• Maven org.elasticsearch:elasticsearch: < 6.8.14 → fixed in 6.8.14 • Maven org.elasticsearch:elasticsearch: >= 7.0.0, < 7.10.0 → fixed in 7.10.0

Description

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.

Related

Alias · CVE (1)

  • CVE-2020-7021 Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References