Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure
    issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried,
    could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow
    an authenticated Elasticsearch user to improperly view these details. (CVE-2018-3831)

An update of the elasticsearch package has been released.

ID	Name	Product	Family	Type	Severity
418629	SCA: security update for org.elasticsearch:elasticsearch (GHSA-r9fv-qpm9-rj4g)	Tenable Cloud Security	SCA Checks	Local	high
418629	SCA: security update for org.elasticsearch:elasticsearch (GHSA-r9fv-qpm9-rj4g)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
203107	Photon OS 2.0: Elasticsearch PHSA-2018-2.0-0116	Nessus	PhotonOS Local Security Checks	Local	high
122899	Photon OS 1.0: Elasticsearch PHSA-2019-1.0-0205	Nessus	PhotonOS Local Security Checks	Local	high
117665	Elasticsearch ESA-2018-15	Nessus	CGI abuses	Remote	high

Detections

Analytics

CVE-2018-3831

high

Tenable Plugins

high

high

high

high

high