CVE-2020-7021

MEDIUM4.9EPSS 0.29%

Insertion of Sensitive Information into Log File in Elasticsearch

發布日:2022/5/24修改日:2025/4/3

也稱為:GHSA-cqgv-256r-m9r8BIT-elasticsearch-2020-7021

描述

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.

受影響套件(2)

Bitnami/elasticsearchfrom 0, < 6.8.14, >= 7.0.0, < 7.10.0
Maven/org.elasticsearch:elasticsearchfrom 0, < 6.8.14

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-7021
PATCHhttps://github.com/elastic/elasticsearch
WEBhttps://discuss.elastic.co/t/elastic-stack-7-11-0-and-6-8-14-security-update/263915
WEBhttps://security.netapp.com/advisory/ntap-20210319-0003
WEBhttps://security.netapp.com/advisory/ntap-20210319-0003/