CVE-2023-49923
Enterprise Search Insertion of Sensitive Information into Log File
- State
- Published
- Severity
- 6.8 Medium
- Published
- Dec 12, 2023
- Updated
- May 24, 2025
- Reserved
- Dec 2, 2023
Description
An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by changing the log level at which these are logged to DEBUG, which is disabled by default.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | elastic |
Weaknesses
- CWE-532 Insertion of Sensitive Information into Log File
Affected Products
| Product | Versions |
|---|---|
Enterprise SearchElastic |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.