CVE-2017-8442

6.5MEDIUM

Key Information:

Vendor
Elastic
Status
Elasticsearch X-pack Security
Vendor
CVE Published:
7 July 2017

Summary

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details.

Affected Version(s)

Elasticsearch X-Pack Security 5.0.0 to 5.4.3

References

https://www.elastic.co/community/security
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.