CVE-2018-3831

2018-09-1919:00:00

CWE-200

elastic

www.cve.org

8.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.0%

JSON

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.

CNA Affected

[
  {
    "product": "Elasticsearch",
    "vendor": "Elastic",
    "versions": [
      {
        "status": "affected",
        "version": "before 5.6.12 and 6.4.1"
      }
    ]
  }
]