Low WID-SEC-2023-2276 1 CVE

Elasticsearch: Schwachstelle ermöglicht Offenlegung von Informationen

Published Sep 6, 2023 · Updated Sep 6, 2023 · de-DE

Platform: Linux Platform: Windows

Summary

Ein lokaler Angreifer kann eine Schwachstelle in Elasticsearch ausnutzen, um Informationen offenzulegen.

Product

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.

Vulnerabilities 1

Medium 4.1

CVE-2023-31417

Elasticsearch Insertion of sensitive information in audit logs

Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that se…

Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven

Oct 26, 2023

Revision history

2023-09-06 #1
Initiale Fassung

References

Elastic Security Update vom 2023-09-06
https://discuss.elastic.co/t/elasticsearch-8-9-2-and-7-17-13-security-update/342479