Elastic Logstash
9 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-33466 | 8.0.0 – 8.19.13 | Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write | CRITICAL 9.8 | 0.5 % | ||
| CVE-2025-37730 | 8.0.0 – < 8.17.6 ; 8.18.0 – < 8.18.1 ; 9.0.0 – < 9.0.1 | Logstash Improper Certificate Validation in TCP output | MEDIUM 6.5 | 0.2 % | ||
| CVE-2023-46672 | 8.10.0 – < 8.11.1 | Logstash Insertion of Sensitive Information into Log File | HIGH 8.4 | 0.3 % | ||
| CVE-2019-7620 | before 7.4.1 and 6.8.4 | Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is | HIGH 7.5 | 2.1 % | ||
| CVE-2019-7613 | before 5.6.16 and 6.6.2 | Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An attacker able to inject certain characters into a log entry | HIGH 7.5 | 1.3 % | ||
| CVE-2019-7612 | before 5.6.15 and 6.6.1 | A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is s | CRITICAL 9.8 | 2.4 % | ||
| CVE-2018-3817 | Before 6.1.2 or 5.6.6 | When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive informatio | MEDIUM 6.5 | 1.0 % | ||
| CVE-2016-10363 | before 2.3.3 | Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX | HIGH 7.5 | 1.5 % | ||
| CVE-2016-10362 | before 5.0.1 | Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth cre | MEDIUM 6.5 | 1.1 % |