Inclusion of sensitive information in log files in Elastic Enterprise Search



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2023-49923
CWE-ID CWE-532
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Enterprise Search
Server applications / Database software

Vendor Elastic Stack

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Inclusion of sensitive information in log files

EUVDB-ID: #VU84393

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-49923

CWE-ID: CWE-532 - Information Exposure Through Log Files

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. A remote user can view the log files and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Enterprise Search: 7.7.0 - 8.11.1

CPE2.3 External links

http://discuss.elastic.co/t/enterprise-search-8-11-2-7-17-16-security-update-esa-2023-31/349181
http://www.elastic.co/community/security#ESA-2023-31


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###