Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Enterprise Search Insertion of Sensitive Information into Log File (Elastic Enterprise Search)

CVE-2023-49923
MEDIUM 6.8

At a glance

Source
NVD
EPSS
EPSS 0.59 % · percentile 48 ()
State
PUBLISHED
Published
Updated
Assigner
elastic
NVD status
Modified

Search on…

Description

An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by changing the log level at which these are logged to DEBUG, which is disabled by default.

Weaknesses (CWE)

  • CWE-532 — Insertion of Sensitive Information into Log File

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 6.8CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nelastic
CVSS 3.1MEDIUM 6.8CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NNVD · security@elastic.co (Secondary)
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Elastic · Enterprise Searchaffected 7.0.0 < 7.17.16 ; affected 8.0.0 < 8.11.2

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD