CVE-2017-8442 Vulnerability Details

  /     /     /  

CVE-2017-8442 Metadata Quick Info

CVE Published: 07/07/2017 | CVE Updated: 05/08/2024 | CVE Year: 2017
Source: elastic | Vendor: Elastic | Product: Elasticsearch X-Pack Security
Status : PUBLISHED

---

CVE-2017-8442 Description

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-402
CWE Name: CWE-402: Transmission of Private Resources into a New Sphere ( Resource Leak )
Source: Elastic

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).