PT-2025-18390 · Elastic · Apm Server

Published 2025-05-01 · Updated 2025-05-02 · CVE-2024-11994

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elasticsearch APM Server (affected versions not specified)

Description The issue concerns the potential disclosure of sensitive information in APM Server error logs. This could happen when a bulk index request partially fails, causing parts of the document body to be logged. The nature of the document determines the sensitivity of the information that could be disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-11994

Affected Products

Apm Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-11994 · Security Note
• https://discuss.elastic.co/t/apm-server-8-16-1-security-update-esa-2024-41/377710 · Note
• https://twitter.com/CVEnew/status/1918181392359539147 · Twitter Post