PT-2018-16222 · Elastic · Cloud Enterprise

Publicado 2018-09-19 · Atualizado 2019-10-09 · CVE-2018-3828

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elastic Cloud Enterprise (ECE) versions prior to 1.1.4

Description The issue allows certain exception conditions to result in encryption keys, passwords, and other security-sensitive headers being leaked to the allocator logs. An attacker with access to the logging cluster may obtain leaked credentials and perform authenticated actions using these credentials.

Recommendations For versions prior to 1.1.4, update to version 1.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the logging cluster to minimize the risk of exploitation.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2018-3828

Produtos afetados

Cloud Enterprise

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-3828 · Aviso do Fabricante
• https://elastic.co/community/security · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-3828 · Nota de Segurança
• https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778 · Aviso do Fabricante