CVE-2021-22133CWE-532

The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic

published February 10, 2021

CVSS
—
EPSS
1%
Percentile
43.4
In the wild
Unconfirmed
What it is

The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00521 · 43.4th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2021-02-10T18:55Z
EPSS history
Timeline
  • 10 FEB 18:55Z
    The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic
    cvelistv5