CVE-2024-37286: APM Server Insertion of Sensitive Information into Log File
APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailableshardsexception for a specific document, since the ES response line contains the document body, and that APM server logs the ES response line on error, the document is effectively logged.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37286?
The severity of CVE-2024-37286 is classified as moderate due to the potential exposure of sensitive document data in APM server logs.
How do I fix CVE-2024-37286?
To mitigate CVE-2024-37286, upgrade to APM Server version 8.14.0 or later.
What systems are affected by CVE-2024-37286?
CVE-2024-37286 affects all versions of the Elastic APM Server prior to 8.14.0.
What data is exposed by CVE-2024-37286?
CVE-2024-37286 may expose the document body from a partially failed bulk index request in APM server logs.
Can CVE-2024-37286 lead to unauthorized access?
While CVE-2024-37286 does not directly lead to unauthorized access, it can inadvertently expose sensitive data in logs.