vulnwire
6.5med

CVE-2017-8442

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configura…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 61%
Public exploits
0
none known

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details.

Exploit prediction (EPSS)

0.92% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD2.04.0AV:N/AC:L/Au:S/C:P/I:N/A:N

Affected products

  • Elastic Elasticsearch X-Pack Security

Classification

Weakness
  • CWE-402 Transmission of Private Resources into a New Sphere
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • elastic.co /community/security · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.