Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

2022-05-2417:00:08

Google

osv.dev

0.002 Low

EPSS

Percentile

52.1%

JSON

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm.

CPENameOperatorVersion
org.elasticsearch:elasticsearcheq6.8.3
org.elasticsearch:elasticsearcheq7.2.1
org.elasticsearch:elasticsearcheq7.3.2
org.elasticsearch:elasticsearcheq7.3.0
org.elasticsearch:elasticsearcheq6.7.2
org.elasticsearch:elasticsearcheq6.8.1
org.elasticsearch:elasticsearcheq7.1.1
org.elasticsearch:elasticsearcheq6.8.0
org.elasticsearch:elasticsearcheq7.0.1
org.elasticsearch:elasticsearcheq7.2.0

Name	Operator	Version
org.elasticsearch:elasticsearch	eq	6.8.3
org.elasticsearch:elasticsearch	eq	7.2.1
org.elasticsearch:elasticsearch	eq	7.3.2
org.elasticsearch:elasticsearch	eq	7.3.0
org.elasticsearch:elasticsearch	eq	6.7.2
org.elasticsearch:elasticsearch	eq	6.8.1
org.elasticsearch:elasticsearch	eq	7.1.1
org.elasticsearch:elasticsearch	eq	6.8.0
org.elasticsearch:elasticsearch	eq	7.0.1
org.elasticsearch:elasticsearch	eq	7.2.0