PT-2018-16220 · Elastic · Elasticsearch

Published 2018-09-19 · Updated 2019-10-09 · CVE-2018-3826

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elasticsearch versions 6.0.0-beta1 through 6.2.4

Description A disclosure flaw was found in the snapshot API. When the access key and security key parameters are set using the snapshot API, they can be exposed as plain text by users able to query the snapshot API.

Recommendations For Elasticsearch versions 6.0.0-beta1 through 6.2.4, consider restricting access to the snapshot API to minimize the risk of exploitation. As a temporary workaround, avoid using the access key and security key parameters in the snapshot API until the issue is resolved.

Fix

Missing Encryption of Sensitive Data

Information Disclosure

Weakness Enumeration

CWE-311

CWE-200

Related Identifiers

CVE-2018-3826

Affected Products

Elasticsearch

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-3826 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3826 · Vendor Advisory
• https://discuss.elastic.co/t/elastic-stack-6-3-0-and-5-6-10-security-update/135777 · Vendor Advisory
• https://elastic.co/community/security · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3826 · Note