CVE-2017-8442 - AskarLabs CVE Database

CVE-2017-8442

Vendor Elastic

Product Elasticsearch X-Pack Security

Weakness CWE-402

Published July 7, 2017

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details.

Key dates

02Disclosure timeline

July 7, 2017 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2017-8442 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/402.html

Related vulnerabilities

04Related CVE

CVE-2025-49618 CVE-2021-23264 Transmission of Private Resources into a New Sphere ('Resource Leak') and Exposure of Resource to Wrong Sphere in Crafter Search CVE-2023-38509 XWiki Platform's obfuscated email addresses should not be sorted CVE-2021-23263 Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter Engine CVE-2023-4569 Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c