CVE-2018-3826: Infoleak
Published Sep 19, 2018
·Updated
In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the snapshot API. When the accesskey and securitykey parameters are set using the snapshot API they can be exposed as plain text by users able to query the snapshot API.
Affected Software
2 affected components
Elastic Elasticsearch>=6.0.0<=6.2.4
Elastic Elasticsearch=6.0.0-beta1
Event History
Sep 19, 2018
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this disclosure flaw?
The vulnerability ID for this disclosure flaw is CVE-2018-3826.
2
What is the severity level of CVE-2018-3826?
CVE-2018-3826 has a severity level of medium.
3
Which versions of Elasticsearch are affected by CVE-2018-3826?
Elasticsearch versions 6.0.0-beta1 to 6.2.4 are affected by CVE-2018-3826.
4
What is the CWE identifier for this vulnerability?
The CWE identifier for CVE-2018-3826 is CWE-311 and CWE-200.
5
How can the disclosure flaw in CVE-2018-3826 be exploited?
The disclosure flaw in CVE-2018-3826 can be exploited by users who are able to query the _snapshot API in Elasticsearch and access the exposed access_key and security_key parameters.