CVE-2024-23448
Medium
Description
An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.
SeverityMedium
CVSS5.7
Exploit probability—
ProductElastic Apm Server
PublishedFeb 7, 2024
First seenFeb 7, 2024
Weakness typeCWE-532CWE-532
How to fix
Update
- elastic apm_server8.12.1 or later
- github.com/elastic/apm-server8.12.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elastic apm_server | v < 8.12.1 | 8.12.1 |
| github.com/elastic/apm-serverGo | v < 8.12.1, No range specified | 8.12.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.