// For flags

CVE-2023-31417

Elasticsearch Insertion of sensitive information in audit logs

Severity Score

4.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured.

Elasticsearch generalmente filtra la información y las credenciales confidenciales antes de iniciar sesión en el registro de auditoría. Se descubrió que este filtrado no se aplicaba cuando las solicitudes a Elasticsearch utilizan ciertos URI obsoletos para las API. El impacto de esta falla es que la información confidencial, como contraseñas y tokens, puede imprimirse en texto plano en los registros de auditoría de Elasticsearch. Tenga en cuenta que el registro de auditoría está deshabilitado de forma predeterminada y debe habilitarse explícitamente e incluso cuando el registro de auditoría está habilitado, los cuerpos de solicitud que podrían contener información confidencial no se imprimen en el registro de auditoría a menos que se configure explícitamente.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-04-27 CVE Reserved
  • 2023-10-26 CVE Published
  • 2024-01-04 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-532: Insertion of Sensitive Information into Log File
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Elastic
Search vendor "Elastic"
 Elasticsearch
Search vendor "Elastic" for product "Elasticsearch"
 >= 7.0.0 <= 7.17.12
Search vendor "Elastic" for product "Elasticsearch" and version " >= 7.0.0 <= 7.17.12"
-
Affected
Elastic
Search vendor "Elastic"
 Elasticsearch
Search vendor "Elastic" for product "Elasticsearch"
 >= 8.0.0 <= 8.9.1
Search vendor "Elastic" for product "Elasticsearch" and version " >= 8.0.0 <= 8.9.1"
-
Affected