CVE-2023-31417
published 2023-10-26CVE-2023-31417: Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied…
PriorityP417medium4.4CVSS 3.1
AVLACLPRHUINSUCHINAN
EPSS
0.23%
13.5th percentile
Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 7.0.0 < 7.17.12 | 7.17.12 |
| elastic | elasticsearch | 7.0.0 – 7.17.12 | — |
| elastic | elasticsearch | >= 8.0.0 < 8.9.1 | 8.9.1 |
| elastic | elasticsearch | 8.0.0 – 8.9.1 | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
osv4.4MEDIUM
vendor_redhat4.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-31417: Elasticsearch generally filters out sensitive information and credentials before logging to the audit log
osv·2023-10-26·CVSS 4.4
CVE-2023-31417 [MEDIUM] CVE-2023-31417: Elasticsearch generally filters out sensitive information and credentials before logging to the audit log
Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured.
OSV
Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs
osv·2023-10-26
CVE-2023-31417 [MEDIUM] Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs
Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs
Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured.
The `_xpack/security` APIs have been deprecated in Elasticsearch 7.x and were entirely remov
GHSA
Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs
ghsa·2023-10-26
CVE-2023-31417 [MEDIUM] CWE-532 Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs
Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs
Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured.
The `_xpack/security` APIs have been deprecated in Elasticsearch 7.x and were entirely remov
Red Hat
elasticsearch: Sensitive information in audit logs
vendor_redhat·2023-09-06·CVSS 4.1
CVE-2023-31417 [MEDIUM] CWE-532 elasticsearch: Sensitive information in audit logs
elasticsearch: Sensitive information in audit logs
Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured.
A flaw was found in the Elasticsearch package. Elasticsearch filters out sensitive information and credentials before logging into the audi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://discuss.elastic.co/t/elasticsearch-8-9-2-and-7-17-13-security-update/342479https://security.netapp.com/advisory/ntap-20231130-0006/https://www.elastic.co/community/securityhttps://discuss.elastic.co/t/elasticsearch-8-9-2-and-7-17-13-security-update/342479https://security.netapp.com/advisory/ntap-20231130-0006/https://www.elastic.co/community/security
2023-10-26
Published