Medium severity4.9NVD Advisory· Published Aug 23, 2019· Updated Jun 17, 2026

CVE-2019-13421

Description

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Search Guard/Search Guardllm-create
Range: <23.1
Floragunn/Search Guardcpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SySS-2018-025.txtnvdExploitThird Party Advisory
search-guard.com/cve-advisory/nvdVendor Advisory
docs.search-guard.com/6.x-23/changelog-searchguard-6-x-23_1nvdRelease Notes

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

4.9/ 10

Attack vector: Network
Complexity: Low
Privileges: High
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

Probability of exploitation in the next 30 days.

1.13%

VYPR risk score

Composite of severity, exploitation, and reach.

0.32medium

cvss	0.319
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

No CWEs mapped.

CVE ID

CVE-2019-13421

Credits

TS
This security vulnerability was found by Torsten Lutz and Oliver Streicher of SySS GmbH. E-Mail: torsten.lutz (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Torsten_Lutz.asc Key Fingerprint: DAB2 86A6 C099 1350 9FCB FB9B 94E8 DC24 BAEC ACC8 E-Mail: oliver.streicher (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Oliver_Streicher.asc Key Fingerprint: 1973 E30F 7966 F45E CCAB 1BF1 3F08 A35E DCB8 35D6
finder