Login Request a demo
Medium severity · published Sep 19, 2018
CVE-2018-3825
In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters
5.9
CVSS
0.7%
EPSS
No
On KEV
Description
In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable across all ECE deployments. If an attacker can connect to ZooKeeper directly they would be able to access configuration information of other tenants if their cluster ID is known.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Elastic Cloud Enterprise · Elastic
before 1.1.4 · source: NVD
Affected product
EC
Elastic Cloud Enterprise
Elastic
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-3825
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-3825
Vendor Advisory
https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778
Vendor Advisory
https://www.elastic.co/community/security
More from Elastic Cloud Enterprise
9.8
CVE-2024-37282
It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys…
8.8
CVE-2025-37736
Elastic Cloud Enterprise Improper Authorization
7.5
CVE-2023-31418
An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer
7.5
CVE-2018-3828
Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability
7.2
CVE-2025-37729
Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine