CVE-2023-49921: elastic elasticsearch
Vulnerability summary
CVE-2023-49921 is a medium (CVSS 6.5) vulnerability in elastic elasticsearch. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.5% of scored vulnerabilities.
Timeline
- 26-07-2024PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.
CVSS metrics
5 scores · 4 sources · 2 versions- CVE.orgCNA5.2MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · MavenEcosystem advisory · calculated5.2MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
0.00 pp
From 0.45% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Elastic1 product
- elasticsearch≥ 7.0.0, < 7.17.16 | ≥ 8.0.0, < 8.11.2
Org.elasticsearch1 product
- elasticsearch< 7.17.16 | ≥ 8.0.0, < 8.11.2
Ubuntu1 product
- elasticsearchAll versions (No fix recorded)
3 vendors · 3 products
