Vulnerabilities > CVE-2018-3827 - Credentials Management vulnerability in Elastic Azure Repository 6.0.0
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
NONE Availability impact
NONE Summary
A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 3 |
Common Weakness Enumeration (CWE)
Nessus
| NASL family | CGI abuses |
| NASL id | ELASTICSEARCH_ESA_2018_11.NASL |
| description | A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 112046 |
| published | 2018-08-22 |
| reporter | This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/112046 |
| title | Elasticsearch ESA-2018-11 |