CVE-2018-3828
N/A
N/A
Summary
Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would result in encryption keys, passwords, and other security sensitive headers being leaked to the allocator logs. An attacker with access to the logging cluster may obtain leaked credentials and perform authenticated actions using these credentials.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Elastic | Elastic Cloud Enterprise | before 1.1.4 | affected |
Weaknesses
- CWE-532: CWE-532: Information Exposure Through Log Files
ADP Enrichment
CVE Program Container
Additional References
- https://www.elastic.co/community/security
- https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778
References
- https://www.elastic.co/community/security
- https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.