CVE-2020-7021

Description

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.

Risk Information

Base Score

4.9

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.292

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-7021 are fixed in Elasticsearch Core 6.8.14	Windows
Vulnerabilities CVE-2020-7021 are fixed in Elasticsearch Core 7.10.0	Windows
Multiple Vulnerabilities are affected in IBM Business Automation Workflow 21.0	Windows
Vulnerabilities CVE-2020-7021 are fixed in Elasticsearch Core for Linux 6.8.14	Linux
Vulnerabilities CVE-2020-7021 are fixed in Elasticsearch Core for Linux 7.10.0	Linux
Insertion of Sensitive Information into Log File Vulnerability (CVE-2020-7021)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234