CVE-2018-3826

MEDIUM

Elasticsearch 6.0.0-beta1-6.2.4 - Exposure of Sensitive Information via _snapshot API

Title source: llm
STIX 2.1

Description

In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using the _snapshot API they can be exposed as plain text by users able to query the _snapshot API.

References (2)

Core 2
Core References
Vendor Advisory x_refsource_confirm
https://www.elastic.co/community/security

Scores

CVSS v3 6.5
EPSS 0.0069
EPSS Percentile 47.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200 CWE-311
Status published
Products (2)
elastic/elasticsearch 6.0.0 beta1
elastic/elasticsearch 6.0.0 - 6.2.4
Published Sep 19, 2018
Tracked Since Feb 18, 2026