CVE-2019-7612

9.8CRITICAL

Key Information:

Vendor
Elastic
Status
Logstash
Vendor
CVE Published:
25 March 2019

Summary

A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message.

Affected Version(s)

Logstash before 5.6.15 and 6.6.1

References

https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-...
x_refsource_MISC
https://www.elastic.co/community/security
x_refsource_MISC
https://security.netapp.com/advisory/ntap-20190411-0002/
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.