Vulnerability · Published Aug 3, 2024 · Assigned by elastic
CVE-2024-37286APM Server Insertion of Sensitive Information into Log File
Medium 5.7
In plain English
A medium-severity sensitive data in logs in APM Server from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable_shards_exception for a specific document, since the ES response line contains the document body, and that APM server logs the ES response line on error, the document is effectively logged.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/elastic/apm-server | 8.14.0 | GHSA-f6cj-4h3g-hwq4 |
| Go | github.com/elastic/apm-server | no fix listed | GO-2024-3037 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elastic | APM Server | see references |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N