deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-28gg-8qqj-fhh5
Package: org.opensearch.dataprepper.plugins:geoip-processor (MAVEN)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 2.4.0, < 2.12.2
Patched in: 2.12.2

Summary: OpenSearch Data Prepper uses deprecated SSL protocol identifier

Details:
### Impact

The GeoIP processor and Kafka source and buffer were using the deprecated "SSL" protocol identifier when creating SSL contexts, potentially allowing the use of insecure SSL protocols instead of modern TLS versions.

Multiple Data Prepper plugins used `SSLContext.getInstance("SSL")` which could potentially allow the use of deprecated SSL protocols (SSLv2, SSLv3) that have known security vulnerabilities. While modern Java implementations typically default to secure TLS versions even with the "SSL" identifier, explicitly using "TLS" ensures that only secure TLS protocols are negotiated.

The affected components were:

* GeoIP Processor: The `DBSource.initiateSSL()` method used for downloading GeoIP databases from external sources

* Kafka Plugin: Both `CustomClientSslEngineFactory` and `InsecureSslEngineFactory` classes used for Kafka client connections

This could potentially allow connections to negotiate weaker SSL protocols instead of enforcing modern TLS versions, reducing the security of data transmission.

### Patches

Data Prepper 2.12.2 contains a fix for this issue.

### Workarounds

If upgrading is not immediately possible:

1. Ensure your Java runtime is configured to disable deprecated SSL protocols
2. Use network-level controls to enforce TLS-only connections
3. Use external tools to verify that deprecated SSL protocols are not allowed.
GitHub Security Advisory: GHSA-9pp5-9c7g-4r83
Package: org.springframework.security:spring-security-core (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-693: Protection Mechanism Failure
Vulnerable versions: >= 6.4.0, < 6.4.6
Patched in: 6.4.6

Summary: Spring Security authorization bypass for method security annotations on private methods

Details:
Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.

Your application may be affected by this if the following are true:

  *  You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and
  *  You have Spring Security method annotations on a private method
In that case, the target method may be able to be invoked without proper authorization.

You are not affected if:

  *  You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or
  *  You have no Spring Security-annotated private methods
GitHub Security Advisory: GHSA-43ff-rr26-8hx4
Package: org.opensearch.dataprepper.plugins:opensearch (MAVEN)
Severity: HIGH (CVSS 7.4)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 2.12.2
Patched in: 2.12.2

Summary: OpenSearch Data Prepper plugins trust all SSL certificates by default

Details:
### Impact

The OpenSearch sink and source plugins in Data Prepper are configured to trust all SSL certificates by default when no certificate path was provided, making connections vulnerable to man-in-the-middle attacks.

Prior to this fix, the OpenSearch sink and source plugins would automatically use a trust all SSL strategy when connecting to OpenSearch clusters if no certificate path was explicitly configured. This behavior bypassed SSL certificate validation, potentially allowing attackers to intercept and modify data in transit through man-in-the-middle attacks.

The vulnerability affects connections to OpenSearch when the `cert` parameter is not explicitly provided.

### Patches

Data Prepper 2.12.2

### Workarounds

If you cannot immediately upgrade to the fixed version, you can implement the following workaround.

#### OpenSearch sink

Add the `cert` parameter to your OpenSearch sink configuration with the path to your cluster's CA certificate. The following example shows how to accomplish this.

```
sink:
  - opensearch:
      hosts: ["https://your-opensearch-cluster:9200"]
      cert: /path/to/your/ca-certificate.pem
```

#### OpenSearch source

Add the `cert` parameter to your OpenSearch sink configuration with the path to your cluster's CA certificate. The following example shows how to accomplish this.

```
sink:
  - opensearch:
      hosts: ["https://your-opensearch-cluster:9200"]
      connection:
        cert: /path/to/your/ca-certificate.pem
```


### References

N/A
GitHub Security Advisory: GHSA-j4f7-gj7q-xg9m
Package: com.liferay:com.liferay.site.navigation.menu.item.asset.vocabulary (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: < 1.0.23
Patched in: 1.0.23

Summary: Liferay has Incorrect Permission Assignment for Critical Resource

Details:
Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to view it via the Menu Display Widget. This security flaw could result in sensitive information being exposed to unauthorized users.
GitHub Security Advisory: GHSA-6p6v-m64v-jx8q
Package: org.apache.spark:spark-network-common_2.12 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-326: Inadequate Encryption Strength
Vulnerable versions: >= 3.5.0, < 3.5.2
Patched in: 3.5.2

Summary: Apache Spark has Inadequate Encryption Strength

Details:
This issue affects Apache Spark versions before  3.4.4, 3.5.2 and 4.0.0.

Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes.

When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication.

This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows.

To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.
GitHub Security Advisory: GHSA-6p6v-m64v-jx8q
Package: org.apache.spark:spark-network-common_2.12 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-326: Inadequate Encryption Strength
Vulnerable versions: < 3.4.4
Patched in: 3.4.4

Summary: Apache Spark has Inadequate Encryption Strength

Details:
This issue affects Apache Spark versions before  3.4.4, 3.5.2 and 4.0.0.

Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes.

When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication.

This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows.

To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.
GitHub Security Advisory: GHSA-6p6v-m64v-jx8q
Package: org.apache.spark:spark-network-common_2.13 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-326: Inadequate Encryption Strength
Vulnerable versions: < 3.4.4
Patched in: 3.4.4

Summary: Apache Spark has Inadequate Encryption Strength

Details:
This issue affects Apache Spark versions before  3.4.4, 3.5.2 and 4.0.0.

Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes.

When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication.

This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows.

To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.
GitHub Security Advisory: GHSA-6p6v-m64v-jx8q
Package: org.apache.spark:spark-network-common_2.13 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-326: Inadequate Encryption Strength
Vulnerable versions: >= 3.5.0, < 3.5.2
Patched in: 3.5.2

Summary: Apache Spark has Inadequate Encryption Strength

Details:
This issue affects Apache Spark versions before  3.4.4, 3.5.2 and 4.0.0.

Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes.

When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication.

This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows.

To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.
GitHub Security Advisory: GHSA-w595-4975-gm3h
Package: org.apache.geode:geode-web-api (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.1.0, < 1.15.2
Patched in: 1.15.2

Summary: Apache Geode web-api is vulnerable to Cross-site Scripting

Details:
Malicious script injection ('Cross-site Scripting') vulnerability in Apache Geode web-api (REST). This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information and even account takeover.



This issue affects Apache Geode: all versions prior to 1.15.2.

Users are recommended to upgrade to version 1.15.2, which fixes the issue.
GitHub Security Advisory: GHSA-pfwq-mr9g-gq6m
Package: com.liferay.portal:com.liferay.portal.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 99.0.0
Patched in: 99.0.0

Summary: Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key

Details:
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance via the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter.
GitHub Security Advisory: GHSA-mj68-2xr5-28xh
Package: com.liferay:com.liferay.mentions.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.0.35
Patched in: 6.0.35

Summary: Liferay Mentions Web is Vulnerable to Cross-site Scripting

Details:
Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a user’s first, middle or last name text field to (1) page comments widget, (2) blog entry comments, (3) document and media document comments, (4) message board messages, (5) wiki page comments or (6) other widgets/apps that supports mentions.
GitHub Security Advisory: GHSA-fhcw-px4q-pmvv
Package: com.liferay.commerce:com.liferay.commerce.order.content.web (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 4.0.114
Patched in: 4.0.114

Summary: Liferay Commerce Order Content Web is Vulnerable to Authorization Bypass Through User-Controlled Key

Details:
Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.
GitHub Security Advisory: GHSA-3cm9-jrf5-h2cx
Package: com.liferay:com.liferay.change.tracking.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 2.0.120
Patched in: 2.0.120

Summary: Liferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key 

Details:
Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses from a different account via the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter.
GitHub Security Advisory: GHSA-894w-w643-qvxv
Package: com.liferay:com.liferay.change.tracking.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2.0.122
Patched in: 2.0.122

Summary: Liferay Publications is vulnerable to Incorrect Authorization

Details:
Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to view publication comments via the `_com_liferay_change_tracking_web_portlet_PublicationsPortlet_value` parameter.

Publications comments in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 does not properly check user permissions, which allows remote authenticated users to edit publication comments via crafted URLs.
GitHub Security Advisory: GHSA-2hfj-jv6q-762v
Package: com.liferay:com.liferay.change.tracking.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 2.0.122
Patched in: 2.0.122

Summary: Liferay Publications vulnerable to Authorization Bypass Through User-Controlled Key

Details:
Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote authenticated attackers to view the edit page of a publication via the `_com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId` parameter.
GitHub Security Advisory: GHSA-9676-rh83-cr86
Package: com.liferay:com.liferay.change.tracking.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 2.0.9, < 2.0.121
Patched in: 2.0.121

Summary: Liferay Portal is vulnerable to CSRF through publication comments

Details:
Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.
GitHub Security Advisory: GHSA-4g42-gqrg-4633
Package: struts:struts (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 1.2.9
Patched in: unpatched

Summary: Apache Struts vulnerable to memory exhaustion

Details:
Denial of service via out of memory (OOM) owing to no sanity limit on normal form fields in multipart forms. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to an OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory.

Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
GitHub Security Advisory: GHSA-4g42-gqrg-4633
Package: org.apache.struts:struts-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 1.3.10
Patched in: unpatched

Summary: Apache Struts vulnerable to memory exhaustion

Details:
Denial of service via out of memory (OOM) owing to no sanity limit on normal form fields in multipart forms. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to an OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory.

Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
GitHub Security Advisory: GHSA-5ggr-mpgw-3mgx
Package: struts:struts (MAVEN)
Severity: HIGH (CVSS 8.2)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 1.2.9
Patched in: unpatched

Summary: Improper Input Validation in Apache Struts

Details:
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
GitHub Security Advisory: GHSA-7jw3-5q4w-89qg
Package: struts:struts (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 1.2.9
Patched in: unpatched

Summary: Improper Input Validation in Apache Struts

Details:
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
GitHub Security Advisory: GHSA-cvvx-r33m-v7pq
Package: struts:struts (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 1.1, <= 1.2.9
Patched in: unpatched

Summary: Improper Input Validation in Apache Struts

Details:
The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
GitHub Security Advisory: GHSA-xcvw-hh99-qm73
Package: com.liferay:com.liferay.portal.workflow.kaleo.designer.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.56, < 5.0.124
Patched in: 5.0.124

Summary: Liferay Portal is vulnerable to XSS through its workflow process builder

Details:
Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via the crafted input in a workflow definition.
GitHub Security Advisory: GHSA-xw6m-3m5q-mxpm
Package: com.liferay:com.liferay.account.admin.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.40, < 2.0.114
Patched in: 2.0.114

Summary: Liferay Portal's Membership page is vulnerable to XSS through “name“ text field

Details:
Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted payload injected into a Account's “Name“ text field.
GitHub Security Advisory: GHSA-m4g9-5mg6-gfr3
Package: com.liferay.commerce:com.liferay.commerce.order.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.29, < 5.0.101
Patched in: 5.0.101

Summary: Liferay Portal Commerce is vulnerable to XSS through account "name" field

Details:
Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account’s “Name” text field.
GitHub Security Advisory: GHSA-56r7-h6mw-rcfv
Package: org.elasticsearch:elasticsearch (MAVEN)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 9.1.0, < 9.1.5
Patched in: 9.1.5

Summary: Elasticsearch: Insertion of Sensitive Information into Log File via reindex API

Details:
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex
GitHub Security Advisory: GHSA-56r7-h6mw-rcfv
Package: org.elasticsearch:elasticsearch (MAVEN)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 9.0.0-beta1, < 9.0.8
Patched in: 9.0.8

Summary: Elasticsearch: Insertion of Sensitive Information into Log File via reindex API

Details:
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex
GitHub Security Advisory: GHSA-56r7-h6mw-rcfv
Package: org.elasticsearch:elasticsearch (MAVEN)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 8.19.0, < 8.19.5
Patched in: 8.19.5

Summary: Elasticsearch: Insertion of Sensitive Information into Log File via reindex API

Details:
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex
GitHub Security Advisory: GHSA-56r7-h6mw-rcfv
Package: org.elasticsearch:elasticsearch (MAVEN)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 7.0.0, < 8.18.8
Patched in: 8.18.8

Summary: Elasticsearch: Insertion of Sensitive Information into Log File via reindex API

Details:
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex