Elasticsearch ESA-2018-11

Low Nessus Plugin ID 112046


The remote web server hosts a Java application that is affected by an unauthorised information disclosure vulnerability.


A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged.


All users of Elasticsearch should upgrade to version 6.3.0. This update will prevent the repository-azure plugin to expose Azure credentials in Elasticsearch logs.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

See Also


Plugin Details

Severity: Low

ID: 112046

File Name: elasticsearch_esa_2018_11.nasl

Version: 1.5

Type: remote

Family: CGI abuses

Published: 2018/08/22

Updated: 2019/03/04

Dependencies: 109941

Risk Information

Risk Factor: Low

CVSS Score Source: CVE-2018-3827

CVSS v2.0

Base Score: 2.1

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS v3.0

Base Score: 8.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:elastic:x-pack

Patch Publication Date: 2018/06/13

Vulnerability Publication Date: 2018/06/13

Reference Information

CVE: CVE-2018-3827