← All advisories

High severity8.4NVD Advisory· Published Nov 15, 2023· Updated Jun 17, 2026

CVE-2023-46672

CVE-2023-46672

Description

An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances.

The prerequisites for the manifestation of this issue are:

Logstash is configured to log in JSON format https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html , which is not the default logging format.

Sensitive data is stored in the Logstash keystore and referenced as a variable in Logstash configuration.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5

Elastic/Logstash4 versions
cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*range: >=8.10.0,<8.11.1
- cpe:2.3:a:elastic:logstash:7.12.1:*:*:*:*:*:*:*
- (no CPE)
- (no CPE)range: 8.10.0
osv-coords
pkg:bitnami/logstash
Range: >= 7.12.1, < 7.12.2

Patches

Vulnerability mechanics

References

4

www.elastic.co/community/securitynvdVendor Advisory
discuss.elastic.co/t/logstash-8-11-1-security-update-esa-2023-26/347191nvdRelease Notes
security.netapp.com/advisory/ntap-20240125-0002/nvd
security.netapp.com/advisory/ntap-20240229-0001/nvd

News mentions

0

No linked articles in our index yet.