CVE-2024-37286 MEDIUM

CVE-2024-37286: APM Server Insertion of Sensitive Information into Log File

Weakness CWE-532 · Sensitive info in logs
Published August 3, 2024
Last update September 3, 2024

CVSS base score

5.7/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable_shards_exception for a specific document, since the ES response line contains the document body, and that APM server logs the ES response line on error, the document is effectively logged.

Key dates

02Disclosure timeline

August 3, 2024 CVE published
September 3, 2024 Record updated