PT-2017-18336 · Elastic · Cloud Enterprise

Published 2017-09-28 · Updated 2019-10-09 · CVE-2017-8444

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elastic Cloud Enterprise versions prior to 1.0.2

Description The issue concerns the client-forwarder in Elastic Cloud Enterprise, which does not properly encrypt traffic to ZooKeeper. This could allow an attacker to obtain sensitive data if they are able to perform a man-in-the-middle (MITM) attack on the traffic between the client-forwarder and ZooKeeper.

Recommendations For versions prior to 1.0.2, update to version 1.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the ZooKeeper endpoint to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2017-8444

Affected Products

Cloud Enterprise

References · 3

• https://osv.dev/vulnerability/CVE-2017-8444 · Vendor Advisory
• https://discuss.elastic.co/t/elastic-cloud-enterprise-1-0-2-security-update/100247 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8444 · Security Note