Fleet Server sensitive information exposure via logs (Elastic Fleet Server)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.27 % · percentile 20 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- elastic
- NVD status
- Deferred
Description
An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The nature of the sensitive information largely depends on the integrations enabled.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | elastic |
| CVSS 3.1 | CRITICAL 9.0 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · security@elastic.co (Secondary) |
European references
- ENISA EUVD · EUVD-2024-46267
- GCVE · GCVE-0-2024-52975
CERT-FR advisories
- CERTFR-2025-AVI-0062 — Multiples vulnérabilités dans les produits Elastic · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Elastic · Fleet Server | affected 8.13.0 < 8.15.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |