PT-2022-16224 · Ece · Ece

Published 2022-08-25 · Updated 2022-08-31 · CVE-2022-23715

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ECE versions prior to 3.4.0

Description A flaw in ECE might lead to the disclosure of sensitive information, such as user passwords and Elasticsearch keystore settings values, in logs like the audit log or deployment logs in the Logging and Monitoring cluster. The issue affects the "PATCH /api/v1/user" and "PATCH /deployments/{deployment id}/elasticsearch/{ref id}/keystore" API endpoints, specifically the deployment id, ref id variables.

Recommendations For versions prior to 3.4.0, update to version 3.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints "PATCH /api/v1/user" and "PATCH /deployments/{deployment id}/elasticsearch/{ref id}/keystore" until a patch is available. Avoid using sensitive information in the deployment id and ref id variables in the affected API endpoints until the issue is resolved.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2022-23715

Affected Products

Ece

References · 4

• https://osv.dev/vulnerability/CVE-2022-23715 · Vendor Advisory
• https://elastic.co/community/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23715 · Security Note
• https://discuss.elastic.co/t/elastic-cloud-enterprise-3-4-0-security-update/312825 · Vendor Advisory