CVE-2015-5619

MEDIUM

Logstash <1.4.5-1.5.4 - Info Disclosure

Title source: llm

Description

Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack.

References (5)

[Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/133269/Logstash-1.5.3-Man-In-The-Middle.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/76455

[Vendor Advisory] https://www.elastic.co/blog/logstash-1-5-4-and-1-4-5-released

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/536294/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/536858/100/0/threaded

Scores

CVSS v3 5.9

EPSS 0.0031

EPSS Percentile 53.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-295

Status published

Products (10)

elastic/logstash

elastic/logstash

elastic/logstash

elasticsearch/logstash

elasticsearch/logstash

elasticsearch/logstash

elasticsearch/logstash

elasticsearch/logstash

elasticsearch/logstash

n/a/n/a

Published Aug 09, 2017

Tracked Since Feb 18, 2026