CVE-2018-3826
Medium
Description
In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using the _snapshot API they can be exposed as plain text by users able to query the _snapshot API.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Elasticsearch
PublishedSep 19, 2018
First seenSep 19, 2018
Weakness typeCWE-200Sensitive information exposure
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elastic elasticsearch | 6.0.0 ≤ v ≤ 6.2.4, 6.0.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.