9.8

CVE-2019-7612

A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Elastic ≫ Logstash Version < 5.6.15
Elastic ≫ Logstash Version >= 6.0.0 < 6.6.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.41% 0.819
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-209 Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

https://www.elastic.co/community/security
Vendor Advisory
https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077
Vendor Advisory
https://security.netapp.com/advisory/ntap-20190411-0002/
Third Party Advisory