Advisoriesby IbisElasticsearchGHSA-cqgv-256r-m9r8
Insertion of Sensitive Information into Log File in Elasticsearch
Fix: upgrade to 6.8.14 or later (2 fixed versions below)
Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.elasticsearch:elasticsearch Maven | < 6.8.14 | 6.8.14 |
| >= 7.0.0, < 7.10.0 | 7.10.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-532
- Also known as
- BIT-elasticsearch-2020-7021, CVE-2020-7021
More Elasticsearch advisories
All Elasticsearch
Exposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2021-22137fixed in 6.8.15 +1Improper privilege management in elasticsearchCVE-2020-7019fixed in 6.8.12 +1Improper Privilege Management in ElasticsearchCVE-2020-7009fixed in 6.8.8 +1Exposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2019-7619fixed in 6.8.4 +1Concurrent Execution using Shared Resource with Improper Synchronization in ElasticsearchCVE-2019-7614fixed in 6.8.2 +1Improper Limitation of a Pathname to a Restricted Directory in ElasticsearchCVE-2015-3337fixed in 1.4.5 +1