{"id":"CVE-2018-1000060","aliases":["EUVD-2018-0234","GHSA-69mv-3642-wj3w","RHSA-2018:0616","RHSA-2018:1112","RHSA-2018:1606"],"status":"published","title":"Low severity vulnerability that affects sensu","description":"Sensu, Inc. Sensu Core version Before 1.2.0 \u0026 before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redact_sensitive() that can result in sensitive configuration data (e.g. passwords) may be logged in clear-text. This attack appear to be exploitable via victims with configuration matching a specific pattern will observe sensitive data outputted in their service log files. This vulnerability appears to have been fixed in 1.2.1 and later, after commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02359,"percentile":0.83872,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2018-02-09T23:00:00Z","modified":"2026-10-24T10:50:31Z","fixes":[{"ecosystem":"Red Hat:openstack-optools:12::el7","package":"sensu","fixed_in":["0:0.27.0-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack-optools:12::el7","package":"sensu-common","fixed_in":["0:0.27.0-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack-optools:11::el7","package":"sensu","fixed_in":["0:0.27.0-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack-optools:11::el7","package":"sensu-common","fixed_in":["0:0.27.0-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack-optools:10::el7","package":"sensu","fixed_in":["0:0.23.2-4.el7ost"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:openstack-optools:12::el7","package":"sensu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack-optools:12::el7","package":"sensu-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack-optools:11::el7","package":"sensu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack-optools:11::el7","package":"sensu-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack-optools:10::el7","package":"sensu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.23.2-4.el7ost"}]}]}],"products":[{"vendor":"sensu","product":"sensu_core"}],"references":[{"url":"https://github.com/sensu/sensu/pull/1810","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","Vendor Advisory","fix","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0616","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/sensu/sensu/issues/1804","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1606","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1112","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000060","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-69mv-3642-wj3w","tags":["advisory"]},{"url":"https://github.com/sensu/sensu","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1541402","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0616.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000060","tags":["advisory"]},{"url":"https://sensuapp.org/docs/1.2/overview/changelog.html#core-v1-2-1-changes","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1112.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1606.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-1000060","description":"Sensu, Inc. Sensu Core version Before 1.2.0 \u0026 before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redact_sensitive() that can result in sensitive configuration data (e.g. passwords) may be logged in clear-text. This attack appear to be exploitable via victims with configuration matching a specific pattern will observe sensitive data outputted in their service log files. This vulnerability appears to have been fixed in 1.2.1 and later, after commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b.","status":"published","published":"2018-02-09T23:00:00Z","modified":"2024-08-05T12:33:49.051Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-0234","description":"Sensu, Inc. Sensu Core version Before 1.2.0 \u0026 before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redact_sensitive() that can result in sensitive configuration data (e.g. passwords) may be logged in clear-text. This attack appear to be exploitable via victims with configuration matching a specific pattern will observe sensitive data outputted in their service log files. This vulnerability appears to have been fixed in 1.2.1 and later, after commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b.","status":"published","published":"2018-02-09T23:00:00Z","modified":"2024-08-05T12:33:49Z","updated_at":"2026-11-03T02:39:26.824954Z"}],"ghsa":[{"id":"GHSA-69mv-3642-wj3w","title":"Low severity vulnerability that affects sensu","description":"The sensu rubygem prior to version 1.2.0 contains a CWE-522 (Insufficiently Protected Credentials) flaw that can result in sensitive configuration data (e.g. passwords) being logged in clear-text. \n\nUsers are advised to upgrade to rubygem version 1.2.1 or later.","status":"withdrawn","published":"2018-07-23T19:50:22Z","modified":"2023-01-09T05:02:34Z","updated_at":"2026-11-02T14:36:03.040255Z"}],"nvd":[{"id":"CVE-2018-1000060","description":"Sensu, Inc. Sensu Core version Before 1.2.0 \u0026 before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redact_sensitive() that can result in sensitive configuration data (e.g. passwords) may be logged in clear-text. This attack appear to be exploitable via victims with configuration matching a specific pattern will observe sensitive data outputted in their service log files. This vulnerability appears to have been fixed in 1.2.1 and later, after commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b.","status":"published","published":"2018-02-09T23:29:02.213Z","modified":"2026-06-17T01:32:20.453Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:04:22.897995Z"}],"osv":[{"id":"CVE-2018-1000060","description":"Sensu, Inc. Sensu Core version Before 1.2.0 \u0026 before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redact_sensitive() that can result in sensitive configuration data (e.g. passwords) may be logged in clear-text. This attack appear to be exploitable via victims with configuration matching a specific pattern will observe sensitive data outputted in their service log files. This vulnerability appears to have been fixed in 1.2.1 and later, after commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b.","status":"published","published":"2018-02-09T23:29:02.213Z","modified":"2026-10-24T10:50:31.345217417Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"RHSA-2018:0616","title":"Red Hat Security Advisory: sensu security update","status":"published","published":"2024-09-16T01:00:48Z","modified":"2025-11-22T11:27:51Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1112","title":"Red Hat Security Advisory: sensu security update","status":"published","published":"2024-09-16T01:00:53Z","modified":"2025-11-22T11:28:18Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1606","title":"Red Hat Security Advisory: sensu security update","status":"published","published":"2024-09-16T01:00:59Z","modified":"2025-11-22T11:29:50Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"GHSA-69mv-3642-wj3w","title":"Low severity vulnerability that affects sensu","description":"The sensu rubygem prior to version 1.2.0 contains a CWE-522 (Insufficiently Protected Credentials) flaw that can result in sensitive configuration data (e.g. passwords) being logged in clear-text. \n\nUsers are advised to upgrade to rubygem version 1.2.1 or later.","status":"withdrawn","published":"2018-07-23T19:50:22Z","modified":"2026-09-10T03:46:36.753140326Z","updated_at":"2026-11-02T15:46:39.618611Z"}]}}