by Kastro
Paper/Archive/CVE-2023-46668

CVE-2023-46668

Elastic Endpoint — Elastic Endpoint Insertion of Sensitive Information into Log File

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
34
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 34.1.341 × 206.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent is simultaneously configured to collect and send those logs to Elasticsearch, then Elastic Agent API keys can be viewed in Elasticsearch in plaintext. These API keys could be used to write arbitrary data and read Elastic Endpoint user artifacts.

Affected

ProductAffectedFixed inSource
Endpoint7.9.0, 8.10.3–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
elastic (CNA)4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refdiscuss.elastic.co/t/endpoint-v8-10-4-security-update/345203refelastic.co/community/security