← Back

CVE-2023-31416

nvd nist
Published: Oct 26, 2023Modified: Nov 21, 2024

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment.

Affected (1)

Elastic
1 product
Elastic Cloud On Kubernetes
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Elastic Cloud On Kubernetes
Before 2.8
Running on/withPlatform Versions
Elastic
Apm Server
From 8.0.0

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

Source: security@elastic.co
Vendor Advisory
Source: security@elastic.co
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable

Timeline

No history available yet.