Every CVE Search/ Get API key

CVE-2023-49921

Elasticsearch Insertion of Sensitive Information into Log File

5.2 MediumFix available

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.45%Up 0.4 points since Jul 26, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.2

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Record
CVE-2023-49921
CVSS 3.1
5.2 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
EUVDEUVD-2024-2225 5.2

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Record
EUVD-2024-2225
CVSS 3.1
5.2 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-2hjr-vmf3-xwvp 4.1

Elasticsearch Insertion of Sensitive Information into Log File

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Record
GHSA-2hjr-vmf3-xwvp
CVSS 4.0
4.1 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.2 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
NVD 5.2

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Record
CVE-2023-49921
CVSS 3.1
5.2 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSV 5.2

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Record
CVE-2023-49921
CVSS 3.1
5.2 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSVGHSA-2hjr-vmf3-xwvp 4.1

Elasticsearch Insertion of Sensitive Information into Log File

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Record
GHSA-2hjr-vmf3-xwvp
CVSS 4.0
4.1 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.2 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSVUBUNTU-CVE-2023-49921 5.2

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Record
UBUNTU-CVE-2023-49921
CVSS 3.1
5.2 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVBIT-elasticsearch-2023-49921 No score

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Record
BIT-elasticsearch-2023-49921
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.elasticsearch:elasticsearch
Maven
before 7.17.16
7.17.16
org.elasticsearch:elasticsearch
Maven
8.0.0 up to 8.11.2
8.11.2
elasticsearch
Bitnami
7.0.0 up to 7.17.16, 8.0.0 up to 8.11.2
7.17.168.11.2
org.elasticsearch:elasticsearch
Maven
before 7.17.16, plus listed versions
0.10.00.11.00.12.00.12.10.13.0
Show 45 moreShow less
0.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.16.20.16.30.16.40.16.50.17.00.17.10.17.100.17.20.17.30.17.40.17.50.17.60.17.70.17.80.17.90.18.00.18.10.18.20.18.30.18.40.18.50.18.60.18.70.19.00.19.0.RC10.19.0.RC20.19.0.RC30.19.10.19.100.19.110.19.120.19.20.19.30.19.4
7.17.16
org.elasticsearch:elasticsearch
Maven
8.0.0 up to 8.11.2, plus listed versions
8.0.18.1.08.1.18.1.28.1.3
Show 34 moreShow less
8.10.08.10.18.10.28.10.38.10.48.11.08.11.18.2.08.2.18.2.28.2.38.3.08.3.18.3.28.3.38.4.08.4.18.4.28.4.38.5.08.5.18.5.28.5.38.6.08.6.18.6.28.7.08.7.18.8.08.8.18.8.28.9.08.9.18.9.2
8.11.2
elasticsearch
Ubuntu:16.04:LTS
All versions, plus listed versions
1.6.2+dfsg-11.7.3+dfsg-11.7.3+dfsg-21.7.3+dfsg-3
None known

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-49921 is a medium vulnerability (CVSS 5.2) in Elastic Elasticsearch, published July 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 38th percentile. Fixed in org.elasticsearch:elasticsearch 7.17.16.

References

This page doesn't list everything

Left out here: 280 versions. The JSON record has them.

MoveEnter Open