Advisoriesby IbisElasticsearchGHSA-r9fv-qpm9-rj4g
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
Fix: upgrade to 5.6.12 or later (2 fixed versions below)
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.elasticsearch:elasticsearch Maven | >= 5.6.0, < 5.6.12 | 5.6.12 |
| >= 6.0.0, < 6.4.1 | 6.4.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- CVE-2018-3831
More Elasticsearch advisories
All Elasticsearch
Improper Access Control in ElasticsearchCVE-2015-4165fixed in 1.6.0Improper Limitation of a Pathname to a Restricted Directory in ElasticsearchCVE-2015-5531fixed in 1.6.1Improper Restriction of XML External Entity Reference in ElasticsearchCVE-2018-17247fixed in 6.5.2Exposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2018-17244fixed in 6.4.3Elasticsearch subject to cross site scriptingCVE-2018-3824fixed in 5.6.9 +1Improper Access Control in ElasticsearchCVE-2019-7611fixed in 5.6.15 +1