BaseFortify

Publication date: 2025-10-10

Last updated on: 2025-12-23

Assigner: Elastic

Description

Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-10

Last Modified

2025-12-23

Generated

2026-07-06

AI Q&A

2025-10-10

EPSS Evaluated

2026-07-05

NVD

CVE-2025-37727

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 7.0.0 (inc) to 7.17.29 (inc)
elastic	elasticsearch	From 8.0.0 (inc) to 8.18.8 (exc)
elastic	elasticsearch	From 8.19.0 (inc) to 8.19.5 (exc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.0.8 (exc)
elastic	elasticsearch	From 9.1.0 (inc) to 9.1.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability involves the insertion of sensitive information into log files in Elasticsearch when auditing requests to the reindex API. Under specific preconditions, this can lead to a loss of confidentiality as sensitive data may be exposed through the logs.

Impact Analysis

The vulnerability can impact you by exposing sensitive information through Elasticsearch log files, potentially leading to unauthorized access to confidential data. This loss of confidentiality could affect the security of your systems and data.

Hi! I’m here to help you understand CVE-2025-37727. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70