CVE-2023-46668

If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent is simultaneously configured to collect and send those logs to Elasticsearch, then Elastic Agent API keys can be viewed in Elasticsearch in plaintext. These API keys could be used to write arbitrary data and read Elastic Endpoint user artifacts.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/endpoint-v8-10-4-security-update/345203	Release Notes
https://www.elastic.co/community/security	Mitigation Vendor Advisory
https://discuss.elastic.co/t/endpoint-v8-10-4-security-update/345203	Release Notes
https://www.elastic.co/community/security	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:elastic:endpoint:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:29

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-26 00:15

Updated : 2024-11-21 08:29

NVD link : CVE-2023-46668

Mitre link : CVE-2023-46668

CVE.ORG link : CVE-2023-46668

JSON object : View

Products Affected

elastic

endpoint

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2023-46668", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "bressers@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2023-10-26T00:15:12.150", "references": [{"url": "https://discuss.elastic.co/t/endpoint-v8-10-4-security-update/345203", "tags": ["Release Notes"], "source": "bressers@elastic.co"}, {"url": "https://www.elastic.co/community/security", "tags": ["Mitigation", "Vendor Advisory"], "source": "bressers@elastic.co"}, {"url": "https://discuss.elastic.co/t/endpoint-v8-10-4-security-update/345203", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.elastic.co/community/security", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "bressers@elastic.co", "description": [{"lang": "en", "value": "CWE-532"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent is simultaneously configured to collect and send those logs to Elasticsearch, then Elastic Agent API keys can be viewed in Elasticsearch in plaintext. These API keys could be used to write arbitrary data and read Elastic Endpoint user artifacts."}, {"lang": "es", "value": "Si Elastic Endpoint (v7.9.0 - v8.10.3) est\u00e1 configurado para usar una opci\u00f3n no predeterminada en la que el nivel de log est\u00e1 configurado expl\u00edcitamente en debug, y cuando Elastic Agent est\u00e1 configurado simult\u00e1neamente para recopilar y enviar esos registros a Elasticsearch, entonces las claves de API del Agente Elastic se pueden ver en Elasticsearch en texto plano. Estas claves API podr\u00edan usarse para escribir datos arbitrarios y leer artefactos de usuario de Elastic Endpoint."}], "lastModified": "2024-11-21T08:29:01.693", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:endpoint:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "542BBFE6-D7B0-4956-BDFB-F83E3B188F93", "versionEndIncluding": "8.10.3", "versionStartIncluding": "7.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "bressers@elastic.co"}