MEDIUM🇵🇱 Wersja polska

CVE-2017-8442

CVSS 6.5v3.0pub. 2017-07-07upd. 2026-05-13

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

  • Elastic X Pack

    APP
    Elastic
    5.0.0 – 5.4.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2018-3822CRITICAL9.8ten sam produkt

X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect X...

CVE-2017-8448HIGH8.8ten sam produkt

An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to cert...

CVE-2017-8450HIGH7.5ten sam produkt

X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests s...

CVE-2017-8438HIGH8.8ten sam produkt

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality...

CVE-2017-8447MEDIUM6.5ten sam produkt

An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement. If a user has either 'delete' ...