CVE-2018-3831
High
Description
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Elasticsearch
PublishedSep 19, 2018
First seenSep 19, 2018
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- elastic elasticsearch5.6.12, 6.4.1 or later
- org.elasticsearch:elasticsearch5.6.12, 6.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elastic elasticsearch | 5.6.0 ≤ v < 5.6.12, 6.0.0 ≤ v < 6.4.1 | 5.6.12, 6.4.1 |
| org.elasticsearch:elasticsearchMaven | 5.6.0 ≤ v < 5.6.12, 6.0.0 ≤ v < 6.4.1 | 5.6.12, 6.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.