CVE-2023-49922
published 2023-12-12CVE-2023-49922: An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to…
PriorityP434medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.59%
43.7th percentile
An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Beats or Elastic Agent attempted to ingest, this could lead to the insertion of sensitive or private information in the Beats or Elastic Agent logs. Elastic has released 8.11.3 and 7.17.16 that prevents this issue by limiting these types of logs to DEBUG level logging, which is disabled by default.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | beats | >= 7.0.0, 8.0.0 < 7.17.16, 8.11.3 | 7.17.16, 8.11.3 |
| elastic | elastic_beats | >= 7.0.0 < 7.17.16 | 7.17.16 |
| elastic | elastic_beats | >= 8.0.0 < 8.11.3 | 8.11.3 |
| github.com | elastic_beats | >= 7.0.0 < 7.17.16 | 7.17.16 |
| github.com | elastic_beats | >= 8.0.0 < 8.11.3 | 8.11.3 |
| github.com | elastic_beats_v7 | >= 0 < 7.17.16 | 7.17.16 |
| github.com | elastic_beats_v7 | >= 7.0.0 < 7.17.16 | 7.17.16 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Sensitive information logged in github.com/elastic/beats/v7
osv·2024-01-03
CVE-2023-49922 Sensitive information logged in github.com/elastic/beats/v7
Sensitive information logged in github.com/elastic/beats/v7
Sensitive information logged in github.com/elastic/beats/v7
GHSA
Elastic Beats inserts sensitive information into log file
ghsa·2023-12-12
CVE-2023-49922 [MEDIUM] CWE-532 Elastic Beats inserts sensitive information into log file
Elastic Beats inserts sensitive information into log file
An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Beats or Elastic Agent attempted to ingest, this could lead to the insertion of sensitive or private information in the Beats or Elastic Agent logs. Elastic has released 8.11.3 and 7.17.16 that prevents this issue by limiting these types of logs to DEBUG level logging, which is disabled by default.
OSV
Elastic Beats inserts sensitive information into log file
osv·2023-12-12
CVE-2023-49922 [MEDIUM] Elastic Beats inserts sensitive information into log file
Elastic Beats inserts sensitive information into log file
An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Beats or Elastic Agent attempted to ingest, this could lead to the insertion of sensitive or private information in the Beats or Elastic Agent logs. Elastic has released 8.11.3 and 7.17.16 that prevents this issue by limiting these types of logs to DEBUG level logging, which is disabled by default.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-12-12
Published