Moderate severityNVD Advisory· Published Aug 3, 2024· Updated Sep 3, 2024

APM Server Insertion of Sensitive Information into Log File

CVE-2024-37286

Description

APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable_shards_exception for a specific document, since the ES response line contains the document body, and that APM server logs the ES response line on error, the document is effectively logged.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/elastic/apm-serverGo	< 8.14.0	8.14.0

Affected products

osv-coords4 versions
pkg:apk/chainguard/apm-server pkg:apk/chainguard/apm-server-compat pkg:apk/chainguard/apm-server-fips pkg:golang/github.com/elastic/apm-server
< 0+ 3 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 8.14.0
Elastic/Apm Servercpe-rescue
Range: 8.14.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-f6cj-4h3g-hwq4ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-37286ghsaADVISORY
discuss.elastic.co/t/apm-server-8-14-0-security-update-esa-2024-19/364289ghsaWEB
pkg.go.dev/vuln/GO-2024-3037ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000