Inclusion of Sensitive Information in Log Files in Elasticsearch - CVE-2023-31417

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU80623

Inclusion of Sensitive Information in Log Files in Elasticsearch - CVE-2023-31417

Published: September 11, 2023


Vulnerability identifier: #VU80623
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-31417
CWE-ID: CWE-532
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to software can include sensitive information into audit logs log files when using certain deprecated URIs for APIs. A local user with access to the application's log can obtain potentially sensitive information, such as passwords and tokens in clear text.

Note that audit logging is disabled by default and needs to be explicitly enabled.


Affected software

Elasticsearch
watsonx.data
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Cloud Pak for Business Automation

How to mitigate CVE-2023-31417

Install updates from vendor's website.

Elasticsearch - addressed in versions 7.17.13, 8.9.2
watsonx.data - update to 2.0.2
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.8.2
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.6, 5.0.0
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.27, 23.0.1.5

External References

Related Security Bulletins