CVE-2017-8442: elastic elasticsearch x-pack security Resource Leak
Vulnerability summary
CVE-2017-8442 is a medium (CVSS 6.5) Resource Leak vulnerability in elastic elasticsearch x-pack security. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.7% of scored vulnerabilities.
Timeline
- 07-07-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.92%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
0.00 pp
From 0.92% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-402Transmission of Private Resources into a New Sphere ('Resource Leak')The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Elastic2 products
- elasticsearch x-pack security5.0.0 to 5.4.3
- x-pack≥ 5.0.0, ≤ 5.4.3
1 vendor · 2 products