CVE-2018-3831

HIGH

Elasticsearch 5.6.0-5.6.11 - Authenticated Exposure of Sensitive Information via _cluster/settings API

Title source: llm
STIX 2.1

Description

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.

References (2)

Core 2
Core References
Vendor Advisory x_refsource_confirm
https://www.elastic.co/community/security

Scores

CVSS v3 8.8
EPSS 0.0082
EPSS Percentile 74.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-200
Status published
Products (2)
elastic/elasticsearch 5.6.0 - 5.6.12
org.elasticsearch/elasticsearch 5.6.0 - 5.6.12Maven
Published Sep 19, 2018
Tracked Since Feb 18, 2026