CVE-2023-49921
Elasticsearch Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
5.2
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.
- Record
CVE-2023-49921- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
EUVDEUVD-2024-2225
5.2
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.
- Record
EUVD-2024-2225- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2hjr-vmf3-xwvp
4.1
Elasticsearch Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.
- Record
GHSA-2hjr-vmf3-xwvp- CVSS 4.0
- 4.1 Medium
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
NVD
5.2
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.
- Record
CVE-2023-49921- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSV
5.2
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.
- Record
CVE-2023-49921- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVGHSA-2hjr-vmf3-xwvp
4.1
Elasticsearch Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.
- Record
GHSA-2hjr-vmf3-xwvp- CVSS 4.0
- 4.1 Medium
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-49921
5.2
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.
- Record
UBUNTU-CVE-2023-49921- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-elasticsearch-2023-49921 No score
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.
- Record
BIT-elasticsearch-2023-49921- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.elasticsearch:elasticsearchMaven |
before 7.17.16 | 7.17.16 |
org.elasticsearch:elasticsearchMaven |
8.0.0 up to 8.11.2 | 8.11.2 |
elasticsearchBitnami |
7.0.0 up to 7.17.16, 8.0.0 up to 8.11.2 | 7.17.168.11.2 |
org.elasticsearch:elasticsearchMaven |
before 7.17.16, plus listed versions 0.10.00.11.00.12.00.12.10.13.0 Show 45 moreShow less0.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.16.20.16.30.16.40.16.50.17.00.17.10.17.100.17.20.17.30.17.40.17.50.17.60.17.70.17.80.17.90.18.00.18.10.18.20.18.30.18.40.18.50.18.60.18.70.19.00.19.0.RC10.19.0.RC20.19.0.RC30.19.10.19.100.19.110.19.120.19.20.19.30.19.4 |
7.17.16 |
org.elasticsearch:elasticsearchMaven |
8.0.0 up to 8.11.2, plus listed versions 8.0.18.1.08.1.18.1.28.1.3 Show 34 moreShow less8.10.08.10.18.10.28.10.38.10.48.11.08.11.18.2.08.2.18.2.28.2.38.3.08.3.18.3.28.3.38.4.08.4.18.4.28.4.38.5.08.5.18.5.28.5.38.6.08.6.18.6.28.7.08.7.18.8.08.8.18.8.28.9.08.9.18.9.2 |
8.11.2 |
elasticsearchUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.2+dfsg-11.7.3+dfsg-11.7.3+dfsg-21.7.3+dfsg-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-49921 is a medium vulnerability (CVSS 5.2) in Elastic Elasticsearch, published July 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 38th percentile. Fixed in org.elasticsearch:elasticsearch 7.17.16.
References
discuss.elastic.co/t/elasticsearch-8-11-2-7-17-16-security-update-esa-2023-29/349179
nvd.nist.gov/vuln/detail/CVE-2023-49921
github.com/advisories/GHSA-2hjr-vmf3-xwvp
github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49921.json
github.com/elastic/elasticsearch
ubuntu.com/security/CVE-2023-49921
cve.org/CVERecord?id=CVE-2023-49921
Left out here: 280 versions. The JSON record has them.