CVE-2019-7612 — Information Exposure via Error Message in Logstash

CWE-209 — Information Exposure via Error MessageCWE-532 — Log File Information Exposure4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.5%
top 36.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Logstash
Timeline
PublishedMar 25
Latest updateMay 13

Description

A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDelastic/logstash6.0.0 — 6.6.1+1
▶CVEListV5elastic/logstashbefore 5.6.15 and 6.6.1

🔴Vulnerability Details

2
GHSA
GHSA-76jg-hr4p-qmfv: A sensitive data disclosure flaw was found in the way Logstash versions before 5↗2022-05-13
▶
CVEList
CVE-2019-7612: A sensitive data disclosure flaw was found in the way Logstash versions before 5↗2019-03-25
▶

💥Exploits & PoCs

1
Exploit-DB
iOS/macOS - 'task_swap_mach_voucher()' Use-After-Free↗2019-01-25
▶
CVE-2019-7612 — Information Exposure via Error Message | cvebase