Search Guard versions before 23.1 had an issue that an...

4.9 CVSS

Vulnerability Description

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-13421

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

This security vulnerability was found by Torsten Lutz and Oliver Streicher of SySS GmbH. E-Mail: torsten.lutz (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Torsten_Lutz.asc Key Fingerprint: DAB2 86A6 C099 1350 9FCB FB9B 94E8 DC24 BAEC ACC8 E-Mail: oliver.streicher (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Oliver_Streicher.asc Key Fingerprint: 1973 E30F 7966 F45E CCAB 1BF1 3F08 A35E DCB8 35D6