CVE-2016-10362

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials.

Score

CVSS 3.0 6.5 Medium

Status

Modified - security@elastic.co

Published

2017-06-16

Last modified

2024-08-06

Weaknesses

CWE-200, CWE-532

Affected products

• Logstash (Elastic)
• Output Plugin (Elasticsearch)

References

• http://www.securityfocus.com/bid/99154
• https://www.elastic.co/community/security