PT-2025-18390 · Elastic · Apm Server

CVE-2024-11994 · Publicado 2025-05-01 · Atualizado 2025-05-02

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Média

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elasticsearch APM Server (affected versions not specified)

Description The issue concerns the potential disclosure of sensitive information in APM Server error logs. This could happen when a bulk index request partially fails, causing parts of the document body to be logged. The nature of the document determines the sensitivity of the information that could be disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2024-11994

Produtos afetados

Apm Server

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11994.json · Exploit
• https://github.com/elastic/apm-server · Nota
• https://discuss.elastic.co/t/apm-server-8-16-1-security-update-esa-2024-41/377710 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-11994 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2024-11994 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1918181392359539147 · Publicação no Twitter