There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure
    issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried,
    could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow
    an authenticated Elasticsearch user to improperly view these details. (CVE-2018-3831)

在 6.4.1 或 5.6.12 之前的 Elasticsearch 警报和监控版本中，通过 API 配置隐私时，存在信息泄露问题。当查询时，Elasticsearch _cluster/settings API 可泄露敏感配置信息（例如密码、令牌或用户名）。此问题可允许经身份验证的 Elasticsearch 用户错误查看上述详细信息。

6.4.1 版或 5.6.12 版之前的 Elasticsearch Alerting 和 Monitoring，當透過 API 設定密碼時，存在一個資訊洩漏問題。當查詢時，Elasticsearch _cluster/settings API 可能洩漏敏感的組態資訊，例如密碼、token 或使用者名稱。這可允許經驗證的 Elasticsearch 使用者不當檢視這些詳細資料。

Elasticsearch Alerting and Monitoringの6.4.1より前または5.6.12のバージョンでは、APIを介して秘密を設定したときに情報漏えいの問題があります。Elasticsearchの_cluster/settings APIはクエリされたとき、パスワード、トークン、ユーザー名などの重要な設定情報を漏えいさせる可能性があります。これにより、認証されたElasticsearchユーザーがこれらの詳細を不適切に表示する可能性があります。

An update of the elasticsearch package has been released.

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
418629	SCA: security update for org.elasticsearch:elasticsearch (GHSA-r9fv-qpm9-rj4g)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	high
418629	SCA: security update for org.elasticsearch:elasticsearch (GHSA-r9fv-qpm9-rj4g)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	high
117665	Elasticsearch ESA-2018-15	Nessus	CGI abuses	2018/9/24	2019/11/4	high
117665	Elasticsearch ESA-2018-15	Nessus	CGI abuses	2018/9/24	2019/11/4	high
117665	Elasticsearch ESA-2018-15	Nessus	CGI abuses	2018/9/24	2019/11/4	high
122899	Photon OS 1.0: Elasticsearch PHSA-2019-1.0-0205	Nessus	PhotonOS Local Security Checks	2019/3/18	2022/5/23	high
203107	Photon OS 2.0: Elasticsearch PHSA-2018-2.0-0116	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
117665	Elasticsearch ESA-2018-15	Nessus	CGI abuses	2018/9/24	2019/11/4	high

检测

插件搜索

high

high

high

high

high

high

high

high