CVE-2023-46668

Elastic Endpoint Insertion of Sensitive Information into Log File

CVSS 4.6 MEDIUMEPSS 0.3%CWE-532

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.6EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

25 Oct 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent is simultaneously configured to collect and send those logs to Elasticsearch, then Elastic Agent API keys can be viewed in Elasticsearch in plaintext. These API keys could be used to write arbitrary data and read Elastic Endpoint user artifacts.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Affected products

Elastic · Endpoint

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://discuss.elastic.co/t/endpoint-v8-10-4-security-update/345203 https://www.elastic.co/community/security