CVE-2020-7021

State: Published
Severity: Not scored
Published: Feb 10, 2021
Updated: Aug 4, 2024
Reserved: Jan 14, 2020

Description

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.

Scores

The record has no CVSS score.

Weaknesses

CWE-532 Insertion of Sensitive Information into Log File

Affected Products

Product	Versions
ElasticsearchElastic	before 7.10.0 and 6.8.14Affected

References

https://discuss.elastic.co/t/elastic-stack-7-11-0-and-6-8-14-security-update/263915
https://security.netapp.com/advisory/ntap-20210319-0003/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.