CVE-2019-7619CWE-200

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service

published October 30, 2019

CVSS
—
EPSS
2%
Percentile
84.1
In the wild
Unconfirmed
What it is

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02429 · 84.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2019-10-30T13:37Z
EPSS history
Timeline
  • 30 OCT 13:37Z
    Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service
    cvelistv5