Critical severity · published Jan 23, 2025
CVE-2024-52975
Fleet Server sensitive information exposure via logs
9.0
CVSS
0.3%
EPSS
No
On KEV
Description
An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The nature of the sensitive information largely depends on the integrations enabled.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FS
Fleet Server · Elastic
8.13.0 before 8.15.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52975
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52975
discuss.elastic.co
https://discuss.elastic.co/t/fleet-server-8-15-0-security-update-esa-2024-31/373522
More from Fleet Server
9.1
CVE-2026-72676
Improper Control of Generation of Code in Fleet Server Leading to Code Injection
8.1
CVE-2023-46667
Fleet Server Insertion of Sensitive Information into Log File
7.5
CVE-2026-56150
Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service
7.5
CVE-2023-31421
Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue
6.5
CVE-2026-72657
Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure