CVE-2018-3831 (High) detected in elasticsearch-5.6.8.jar

[mend-for-github-com]

CVE-2018-3831 - High Severity Vulnerability

Vulnerable Library - elasticsearch-5.6.8.jar

Elasticsearch subproject :core

Library home page: https://github.com/elastic/elasticsearch

Dependency Hierarchy:

• ❌ elasticsearch-5.6.8.jar (Vulnerable Library)

Found in HEAD commit: 8c55da57e6742a71db36a297b399eb3abb06431c

Found in base branch: master

Vulnerability Details

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.

Publish Date: 2018-09-19

URL: CVE-2018-3831

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035

Release Date: 2018-09-19

Fix Resolution: org.elasticsearch:elasticsearch:5.6.12,6.4.1

---

⛑️ Automatic Remediation is available for this issue