Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch

2022-05-1301:27:27

Google

osv.dev

0.001 Low

EPSS

Percentile

34.0%

JSON

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.

CPENameOperatorVersion
org.elasticsearch:elasticsearcheq6.2.2
org.elasticsearch:elasticsearcheq6.1.0
org.elasticsearch:elasticsearcheq6.2.1
org.elasticsearch:elasticsearcheq6.2.0
org.elasticsearch:elasticsearcheq6.0.0
org.elasticsearch:elasticsearcheq5.6.4
org.elasticsearch:elasticsearcheq5.6.8
org.elasticsearch:elasticsearcheq5.6.1
org.elasticsearch:elasticsearcheq6.1.1
org.elasticsearch:elasticsearcheq6.1.3

Name	Operator	Version
org.elasticsearch:elasticsearch	eq	6.2.2
org.elasticsearch:elasticsearch	eq	6.1.0
org.elasticsearch:elasticsearch	eq	6.2.1
org.elasticsearch:elasticsearch	eq	6.2.0
org.elasticsearch:elasticsearch	eq	6.0.0
org.elasticsearch:elasticsearch	eq	5.6.4
org.elasticsearch:elasticsearch	eq	5.6.8
org.elasticsearch:elasticsearch	eq	5.6.1
org.elasticsearch:elasticsearch	eq	6.1.1
org.elasticsearch:elasticsearch	eq	6.1.3