CVE-2019-7619 — Sensitive Information Exposure in Elasticsearch

CWE-200 — Sensitive Information Exposure7 documents6 sources
Severity
5.3MEDIUMNVD
EPSS
1.6%
top 18.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Elasticsearch
Timeline
PublishedOct 30
Latest updateMay 24

Description

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDelastic/elasticsearch6.7.0 — 6.8.3+1
▶CVEListV5elastic/elasticsearch7.0.0, 7.0.1, 7.1.0, 7.1.1, 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 6.7.0, 6.7.1, 6.7.2, 6.8.0, 6.8.1, 6.8.2, 6.8.3

🔴Vulnerability Details

3
GHSA
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch↗2022-05-24
▶
OSV
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch↗2022-05-24
▶
CVEList
CVE-2019-7619: Elasticsearch versions 7↗2019-10-30
▶

📋Vendor Advisories

1
Red Hat
elasticsearch: Username disclosure in API Key service↗2019-10-23
▶

💬Community

2
Bugzilla
CVE-2019-7619 elasticsearch: Username disclosure in API Key service [fedora-all]↗2019-10-23
▶
Bugzilla
CVE-2019-7619 elasticsearch: Username disclosure in API Key service↗2019-10-23
▶
CVE-2019-7619 — Sensitive Information Exposure | cvebase