CVE-2023-31421 — Improper Certificate Validation in APM Server

CWE-295 — Improper Certificate Validation3 documents3 sources
Severity
7.5HIGHNVD
CNA5.9
EPSS
0.1%
top 73.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Elastic APM ServerElastic AgentElastic Beats+3 more
Timeline
PublishedOct 26

Description

It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages8 packages

▶NVDelastic/elastic_fleet_server8.0.0 — 8.9.2
▶CVEListV5elastic/fleet_server8.0.0, 8.9.2
▶NVDelastic/apm_server8.0.0 — 8.9.2
▶CVEListV5elastic/apm_server8.0.0, 8.9.2
▶NVDelastic/elastic_agent8.0.0 — 8.9.2

🔴Vulnerability Details

2
CVEList
Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue↗2023-10-26
▶
GHSA
GHSA-4x46-8gg7-f9vx: It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is↗2023-10-26
▶
CVE-2023-31421 — Improper Certificate Validation | cvebase