CVE-2018-3831

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-19 · updated 2026-06-17
Weakness: CWE-200

Description

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.

Affected products

Elasticsearch: from 5.6.0 before 5.6.12; from 6.0.0 before 6.4.1 — fixed in 5.6.12, 6.4.1

How to fix

Upgrade to a fixed version: Elasticsearch 5.6.12, 6.4.1. Check the vendor advisory for mitigations.

References

https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035
https://www.elastic.co/community/security
https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035
https://www.elastic.co/community/security

Get alerted when CVE-2018-3831 or the next vulnerability affects your stack