CVE-2023-49922CWE-532

Beats Insertion of Sensitive Information into Log File

Medium · published December 12, 2023

CVSS v3.1
6.8
EPSS
1%
Percentile
51.2
In the wild
Unconfirmed
What it is

An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Beats or Elastic Agent attempted to ingest, this could lead to the insertion of sensitive or private information in the Beats or Elastic Agent logs. Elastic has released 8.11.3 and 7.17.16 that prevents this issue by limiting these types of logs to DEBUG level logging, which is disabled by default.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00666 · 51.2th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2023-12-12T18:23Z
EPSS history
Timeline
  • 12 DEC 18:23Z
    Beats Insertion of Sensitive Information into Log File
    cvelistv5