Login Request a demo
Medium severity · published Nov 15, 2023
CVE-2023-46672
An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances. The prerequisites for the manifestation of this issue are: * Logstash is configured to log in JSON format https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html , which is not the default logging format. * Sensitive data is stored in the Logstash keystore and referenced as a variable in Logstash configuration.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Logstash · Elastic
8.10.0 before 8.11.1; 7.12.1 · source: NVD
Affected product
LO
Logstash
Elastic
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46672
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46672
Release Notes
https://discuss.elastic.co/t/logstash-8-11-1-security-update-esa-2023-26/347191
security.netapp.com
https://security.netapp.com/advisory/ntap-20240125-0002/
security.netapp.com
https://security.netapp.com/advisory/ntap-20240229-0001/
Vendor Advisory
https://www.elastic.co/community/security
More from Logstash
9.8
CVE-2026-33466
Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write
9.8
CVE-2019-7612
A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs
7.5
CVE-2019-7620
Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin
7.5
CVE-2015-5378
Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forwarder agent and Logstash server
7.5
CVE-2016-10363
Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX packets could perform a denial of…