VULNERABILITY INTELLIGENCE

CVE-2018-3828

CVSS score7.5 HIGH
EPSS probability0.60%
CISA KEVNot currently listed
Published2018-09-19
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would result in encryption keys, passwords, and other security sensitive headers being leaked to the allocator logs. An attacker with access to the logging cluster may obtain leaked credentials and perform authenticated actions using these credentials.

Weakness classification

  • CWE-532: Insertion of Sensitive Information into Log File

Primary references