CVE-2023-6687 Elastic Agent Insertion of Sensitive Information into Log File
Elastic Agent logs sensitive data when ingestion fails, allowing attackers with log access to view private information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6687?
CVE-2023-6687 is a medium-severity vulnerability in Elastic Agent, published on 12 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered by Elastic whereby Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Elastic Agent attempted to ingest, this could lead to the insertion of sensitive or private information in the Elastic Agent logs. Elastic has released 8.11.3 and 7.17.16 that prevents this issue by limiting these types of logs to DEBUG level logging, which is disabled by default.
Weakness: CWE-532
Which versions are affected by CVE-2023-6687?
It affects 1 product.
Products include Elastic Elastic Agent.
How do I fix CVE-2023-6687?
No fix has been published for CVE-2023-6687 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-6687 being exploited?
There is no known exploitation of CVE-2023-6687 in the wild and no public exploit code.
Other vulnerabilities in Elastic Agent
- CVE-2026-78604 Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM
- CVE-2024-37283 Elastic Agent Insertion of Sensitive Information into Log File
- CVE-2023-46669 Elastic Agent / Elastic Endpoint Security local API key disclosure
- CVE-2024-52976 Elastic Agent Inclusion of Functionality from Untrusted Control Sphere
Sources
Also known as GHSA-xqc7-q7jr-cg3w.