CVE-2018-1000060

Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redact_sensitive() that can result in sensitive configuration data (e.g. passwords) may be logged in clear-text. This attack appear to be exploitable via victims with configuration matching a specific pattern will observe sensitive data outputted in their service log files. This vulnerability appears to have been fixed in 1.2.1 and later, after commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b.

• CWE-532

• https://access.redhat.com/errata/RHSA-2018:0616Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1112Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1606Third Party Advisory
• https://github.com/sensu/sensu/issues/1804Issue Tracking, Vendor Advisory
• https://github.com/sensu/sensu/pull/1810Issue Tracking, Patch, Third Party Advisory, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0616Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1112Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1606Third Party Advisory
• https://github.com/sensu/sensu/issues/1804Issue Tracking, Vendor Advisory
• https://github.com/sensu/sensu/pull/1810Issue Tracking, Patch, Third Party Advisory, Vendor Advisory

Published

Feb 9, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000054Jenkins CCM Plugin 3.1 and earlier processes XML external en…
• CVE-2018-1000055Jenkins Android Lint Plugin 2.5 and earlier processes XML ex…
• CVE-2018-1000056Jenkins JUnit Plugin 1.23 and earlier processes XML external…
• CVE-2018-1000057Jenkins Credentials Binding Plugin 1.14 and earlier masks pa…
• CVE-2018-1000058Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier ha…
• CVE-2018-1000059ValidFormBuilder version 4.5.4 contains a PHP Object Injecti…
• CVE-2018-1000061Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1000062WonderCMS version 2.4.0 contains a Stored Cross-Site Scripti…
• CVE-2018-1000063Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1000064Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1000065Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1000066Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…