GitHub Advisoryadvisory · Maven

GHSA-r9fv-qpm9-rj4g Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

HIGH Published 2022-05-13 Modified 2022-06-28 Official page ↗
Aliases
CVE-2018-3831
Ecosystem
Maven
Packages
org.elasticsearch:elasticsearch
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2022-06-28

Affected packages

• Maven org.elasticsearch:elasticsearch: >= 5.6.0, < 5.6.12 → fixed in 5.6.12 • Maven org.elasticsearch:elasticsearch: >= 6.0.0, < 6.4.1 → fixed in 6.4.1

Description

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.

Related

Alias · CVE (1)

  • CVE-2018-3831 Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References