CVE-2024-23448: APM Server Insertion of Sensitive Information into Log File
An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/elastic/apm-serverto a version that resolves this vulnerability.Fixed in 8.12.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23448?
CVE-2024-23448 is considered a medium severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2024-23448?
To fix CVE-2024-23448, upgrade the APM Server to version 8.12.1 or later.
What are the potential risks associated with CVE-2024-23448?
The risks associated with CVE-2024-23448 include the inadvertent logging of sensitive document data in error messages.
Which versions of APM Server are affected by CVE-2024-23448?
CVE-2024-23448 affects all versions of APM Server prior to 8.12.1.
What does CVE-2024-23448 expose in error logs?
CVE-2024-23448 may expose parts of the original document in error logs when indexing fails.