Lucene search

K
osvGoogleOSV:GO-2024-3037
HistoryAug 06, 2024 - 10:03 p.m.

APM Server vulnerable to Insertion of Sensitive Information into Log File in github.com/elastic/apm-server

2024-08-0622:03:16
Google
osv.dev
5
apm server
github.com/elastic
sensitive information
log file
vulnerability
software

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

18.9%

APM Server vulnerable to Insertion of Sensitive Information into Log File in github.com/elastic/apm-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/elastic/apm-server before v8.14.0.

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

18.9%