CVE-2023-49921

CVE-2023-49921 is a medium-severity vulnerability in Elastic Elasticsearch with a CVSS 3.x base score of 5.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-532.

Key facts

Description

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Frequently asked questions

What is CVE-2023-49921?
An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.
How severe is CVE-2023-49921?
CVE-2023-49921 has a CVSS 3.x base score of 5.2, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2023-49921 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-49921?
CVE-2023-49921 affects Elastic Elasticsearch. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-49921?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2023-49921 have an EU (EUVD) identifier?
Yes. CVE-2023-49921 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-2225.
When was CVE-2023-49921 published?
CVE-2023-49921 was published on 2024-07-26 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Elastic Elasticsearch

All CVEs affecting Elastic Elasticsearch →

Other CWE-532 (Insertion of Sensitive Information into Log File) vulnerabilities

Browse all CWE-532 (Insertion of Sensitive Information into Log File) vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE: