5.3

CVE-2023-31416

Elastic Cloud on Kubernetes (ECK) secret token configuration issue

Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Elastic ≫ Elastic Cloud On Kubernetes Version < 2.8
   Elastic ≫ Apm Server Version >= 8.0.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.28
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Elastic 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://www.elastic.co/community/security
Not Applicable
https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-eck-2-8-security-update/343854
Vendor Advisory