CVE-2024-23448: APM Server Insertion of Sensitive Information into Log File
First published: Wed Feb 07 2024(Updated: )
An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.
Credit: bressers@elastic.co bressers@elastic.co
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/elastic/apm-server | <8.12.1 | 8.12.1 |
| Elastic | <8.12.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-23448?
CVE-2024-23448 is considered a medium severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2024-23448?
To fix CVE-2024-23448, upgrade the APM Server to version 8.12.1 or later.
What are the potential risks associated with CVE-2024-23448?
The risks associated with CVE-2024-23448 include the inadvertent logging of sensitive document data in error messages.
Which versions of APM Server are affected by CVE-2024-23448?
CVE-2024-23448 affects all versions of APM Server prior to 8.12.1.
What does CVE-2024-23448 expose in error logs?
CVE-2024-23448 may expose parts of the original document in error logs when indexing fails.
- agent/title
- agent/weakness
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/references
- agent/author
- collector/github-advisory
- source/GitHub
- alias/GHSA-8r33-q5j5-rh7g
- alias/CVE-2024-23448
- agent/software-canonical-lookup
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-api
- package-manager/go
- vendor/elastic
- canonical/elastic