{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-30T07:35:11.997","vulnerabilities":[{"cve":{"id":"CVE-2024-23444","sourceIdentifier":"security@elastic.co","published":"2024-07-31T18:15:11.983","lastModified":"2025-04-04T23:15:41.133","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation."},{"lang":"es","value":" La ingeniería de Elastic descubrió que cuando se utiliza la herramienta CLI elasticsearch-certutil con la opción csr para crear nuevas solicitudes de firma de certificado, la clave privada asociada que se genera se almacena en el disco sin cifrar incluso si se pasa el parámetro --pass en la invocación del comando."}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-311"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-311"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.17.23","matchCriteriaId":"6BEB91F2-7551-4E99-8960-AE85F82D8761"},{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.13.0","matchCriteriaId":"BA9FE739-3345-4D11-805C-D1A035D57CCE"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-23-security-update-esa-2024-12/364157","source":"security@elastic.co","tags":["Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250404-0001/","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}