CVE-2018-3831 — Sensitive Information Exposure in Elasticsearch

CWE-200 — Sensitive Information Exposure13 documents6 sources
Severity
8.8HIGHNVD
EPSS
0.8%
top 25.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Elasticsearch
Timeline
PublishedSep 19
Latest updateMay 13

Description

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDelastic/elasticsearch5.6.0 — 5.6.12+1
▶CVEListV5elastic/elasticsearchbefore 5.6.12 and 6.4.1

🔴Vulnerability Details

3
OSV
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch↗2022-05-13
▶
GHSA
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch↗2022-05-13
▶
CVEList
CVE-2018-3831: Elasticsearch Alerting and Monitoring in versions before 6↗2018-09-19
▶

📋Vendor Advisories

1
Red Hat
elasticsearch: Information exposure via _cluster/settings API↗2018-09-18
▶

💬Community

8
Bugzilla
CVE-2018-18498 Mozilla: Integer overflow when calculating buffer sizes for images↗2018-12-12
▶
Bugzilla
CVE-2018-18494 Mozilla: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs↗2018-12-12
▶
Bugzilla
CVE-2018-12405 Mozilla: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4↗2018-12-11
▶
Bugzilla
CVE-2018-18492 Mozilla: Use-after-free with select element↗2018-12-11
▶
Bugzilla
CVE-2018-18493 Mozilla: Buffer overflow in accelerated 2D canvas with Skia↗2018-12-11
▶
CVE-2018-3831 — Sensitive Information Exposure | cvebase