CVE-2018-3825CWE-321

In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch…

published September 19, 2018

CVSS
—
EPSS
1%
Percentile
50.6
In the wild
Unconfirmed
What it is

In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable across all ECE deployments. If an attacker can connect to ZooKeeper directly they would be able to access configuration information of other tenants if their cluster ID is known.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00653 · 50.6th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2018-09-19T19:00Z
EPSS history
Timeline
  • 19 SEP 19:00Z
    In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch…
    cvelistv5