-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.elasticsearch:elasticsearch | maven | >= 5.6.0, < 5.6.12 | 5.6.12 |
| org.elasticsearch:elasticsearch | maven | >= 6.0.0, < 6.4.1 | 6.4.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the renderResponse method failing to apply SettingsFilter when serializing cluster settings. The patch adds SettingsFilter as a parameter and uses it in the new ClusterGetSettingsResponse class to filter sensitive values. The pre-patch version of renderResponse (with 4 parameters) directly exposed state.metaData().persistentSettings()/transientSettings() without filtering, which would appear in profilers when processing _cluster/settings API requests.
A Semantic Attack on Google Gemini - Read the Latest Research