CVE-2025-37727
CVE-2025-37727 · Elasticsearch Insertion of sensitive information in log file
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex
CVSS 5.7 · Medium · EPSS 0.3%
- Published
- Updated
Stack: system
Affected products and versions
elasticsearch
- Versions
- ≥ 7.0.0, ≤ 7.17.29: Affected (semver)
- ≥ 8.0.0, ≤ 8.18.7: Affected (semver)
- ≥ 8.19.0, ≤ 8.19.4: Affected (semver)
- ≥ 9.0.0, ≤ 9.0.7: Affected (semver)
- ≥ 9.1.0, ≤ 9.1.4: Affected (semver)
No fix published
elasticsearch Ubuntu:16.04:LTS
- Versions
- 1.6.2+dfsg-1
- 1.7.3+dfsg-1
- 1.7.3+dfsg-2
- 1.7.3+dfsg-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published