CVE-2018-3817
30.03.2018, 20:29
When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive information.Enginsight
| Vendor | Product | Version |
|---|---|---|
| elastic | logstash | 𝑥 < 5.6.6 |
| elastic | logstash | 6.0.0 ≤ 𝑥 < 6.1.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-532 - Insertion of Sensitive Information into Log FileInformation written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
- CWE-200 - Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.