Vulnerability DatabaseCVE-2024-37286

CVE-2024-37286:
vulnerability analysis and mitigation

Overview

The vulnerability (CVE-2024-37286) affects Elastic's APM server versions prior to 8.14.0. The issue involves the APM server logging document bodies from partially failed bulk index requests. When an unavailableshardsexception occurs for a specific document, the Elasticsearch response line containing the document body is logged by the APM server on error, effectively exposing potentially sensitive information in the logs (Elastic Advisory).

Technical details

The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File). It has been assigned a CVSS v3.1 base score of 6.5 (Medium) by NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, while Elastic assessed it at 5.7 (Medium) with a vector string of CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (NVD).

Impact

The vulnerability could lead to the exposure of sensitive information contained in document bodies through server logs. This occurs specifically when there are partially failed bulk index requests, potentially compromising data confidentiality (Elastic Advisory).

Mitigation and workarounds

The vulnerability has been fixed in APM Server version 8.14.0. Users are advised to upgrade to this version to resolve the issue. Additionally, users should review their logs for potential sensitive information exposure by searching for specific message patterns (Elastic Advisory).