High severity · published Feb 7, 2024
CVE-2024-23448
An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain…
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Apm Server · Elastic
before 8.12.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23448
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23448
Vendor Advisory
https://discuss.elastic.co/t/apm-server-8-12-1-security-update-esa-2024-03/352688
Vendor Advisory
https://www.elastic.co/community/security
More from Apm Server
7.5
CVE-2023-31421
It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP…
6.5
CVE-2024-37286
APM server logs contain document body from a partially failed bulk index request
4.9
CVE-2026-78594
Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service