CVE-2018-3826CWE-200

In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API

published September 19, 2018

CVSS
—
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using the _snapshot API they can be exposed as plain text by users able to query the _snapshot API.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00692 · 52.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2018-09-19T19:00Z
EPSS history
Timeline
  • 19 SEP 19:00Z
    In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API
    cvelistv5