CVE-2020-7021CWE-532

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled

published February 10, 2021

CVSS
—
EPSS
1%
Percentile
73.6
In the wild
Unconfirmed
What it is

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01472 · 73.6th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2021-02-10T18:55Z
EPSS history
Timeline
  • 10 FEB 18:55Z
    Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled
    cvelistv5