VULNERABILITY INTELLIGENCE

CVE-2019-13421

CVSS score4.9 MEDIUM

EPSS probability1.13%

CISA KEVNot currently listed

Published2019-08-23

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Description

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database.

Weakness classification

security@search-guard.com: CWE-522
nvd@nist.gov: CWE-200

Primary references

security@search-guard.com — Release Notes
security@search-guard.com — Vendor Advisory
security@search-guard.com — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory