APM Server Insertion of Sensitive Information into Log File (Elastic APM Server)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.67 % · percentile 52 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- elastic
- NVD status
- Modified
Description
An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.
Weaknesses (CWE)
- CWE-532 — Insertion of Sensitive Information into Log File
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.7 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | elastic |
| CVSS 3.1 | MEDIUM 5.7 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · security@elastic.co (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-8r33-q5j5-rh7g — APM Server vulnerable to Insertion of Sensitive Information into Log File
- GO-2024-2556 — APM Server vulnerable to Insertion of Sensitive Information into Log File in github.com/elastic/apm-server
European references
- ENISA EUVD · EUVD-2024-0582
- GCVE · GCVE-0-2024-23448
CERT-FR advisories
- CERTFR-2024-AVI-0099 — Multiples vulnérabilités dans les produits Elastic · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:elastic:apm_server:*:*:*:*:*:*:*:*< 8.12.1
Affected products
| Product | Versions |
|---|---|
| Elastic · APM Server | affected 8.12 < 8.12.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |