Skip to content
OpenAdvisories
Medium WID-SEC-2023-3126 2 CVEs

Elasticsearch: Mehrere Schwachstellen

Published Dec 12, 2023 · Updated Dec 12, 2023 · de-DE

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Elasticsearch ausnutzen, um Informationen offenzulegen.

Product

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.

Vulnerabilities 2

  • Medium 6.8
    CVE-2023-49923

    Enterprise Search Insertion of Sensitive Information into Log File

    An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the…

    Elastic Enterprise Search
  • Medium 5.2
    CVE-2023-49921

    Elasticsearch Insertion of Sensitive Information into Log File

    An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolv…

    Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven

Revision history

  1. #1

    Initiale Fassung

References