Vulnerability · Published Aug 8, 2024 · Assigned by elastic
CVE-2024-37283Elastic Agent Insertion of Sensitive Information into Log File
Medium 6.5
In plain English
A medium-severity sensitive data in logs in Elastic Agent from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 4.0)6.5Medium
Exploit odds (30 days)0.6%top 53.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured to debug. By default the log level is set to info, where no leak occurs.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Elastic Agent | 8.6.0 – before 8.15.0 |
Weakness: CWE-532 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H