Vulnerability · Published Oct 25, 2023 · Assigned by elastic
CVE-2023-46668Elastic Endpoint Insertion of Sensitive Information into Log File
Medium 4.6
In plain English
A medium-severity sensitive data in logs in Endpoint from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent is simultaneously configured to collect and send those logs to Elasticsearch, then Elastic Agent API keys can be viewed in Elasticsearch in plaintext. These API keys could be used to write arbitrary data and read Elastic Endpoint user artifacts.
Affected products (as reported)
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N