CVE-2024-23448

2024-02-0722:15:09

CWE-532

[email protected]

web.nvd.nist.gov

apm server

cve

security

error logging

elasticsearch

data privacy

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.4%

JSON

An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.

Affected configurations

NVD

Node

elasticapm_serverRange<8.12.1

CPENameOperatorVersion
elastic:apm_serverelastic apm serverlt8.12.1

CPE	Name	Operator	Version
elastic:apm_server	elastic apm server	lt	8.12.1

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "APM Server",
    "vendor": "Elastic",
    "versions": [
      {
        "lessThan": "8.12.1",
        "status": "affected",
        "version": "8.12",
        "versionType": "semver"
      }
    ]
  }
]