CVE-2024-37283 — Log File Information Exposure in Agent

CWE-532 — Log File Information Exposure3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 40.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Agent
Timeline
PublishedAug 12

Description

An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured to debug. By default the log level is set to info, where no leak occurs.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Affected Packages2 packages

▶CVEListV5elastic/elastic_agent8.6.0 — 8.15.0
▶NVDelastic/elastic_agent8.6.0 — 8.15.0

Patches

Patch: discuss.elastic.co ↗

🔴Vulnerability Details

2
GHSA
GHSA-9mq7-8hm8-q3mp: An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent↗2024-08-12
▶
CVEList
Elastic Agent Insertion of Sensitive Information into Log File↗2024-08-08
▶
CVE-2024-37283 — Log File Information Exposure | cvebase