PT-2017-18336 · Elastic · Cloud Enterprise

Publicado 2017-09-28 · Atualizado 2019-10-09 · CVE-2017-8444

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elastic Cloud Enterprise versions prior to 1.0.2

Description The issue concerns the client-forwarder in Elastic Cloud Enterprise, which does not properly encrypt traffic to ZooKeeper. This could allow an attacker to obtain sensitive data if they are able to perform a man-in-the-middle (MITM) attack on the traffic between the client-forwarder and ZooKeeper.

Recommendations For versions prior to 1.0.2, update to version 1.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the ZooKeeper endpoint to minimize the risk of exploitation.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2017-8444

Produtos afetados

Cloud Enterprise

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-8444 · Aviso do Fabricante
• https://discuss.elastic.co/t/elastic-cloud-enterprise-1-0-2-security-update/100247 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8444 · Nota de Segurança