CVE-2017-8442CWE-402

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information…

published July 7, 2017

CVSS
—
EPSS
1%
Percentile
59.8
In the wild
Unconfirmed
What it is

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00924 · 59.8th percentile
Weakness
CWE-402 · Transmission of Private Resources into a New Sphere ('Resource Leak')
Published
2017-07-07T20:00Z
EPSS history
Timeline
  • 07 JUL 20:00Z
    Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information…
    cvelistv5