Elastic Cloud Enterprise Elastic Cloud Enterprise

Do you want an email whenever new security vulnerabilities are reported in Elastic Cloud Enterprise?

By the Year

In 2023 there have been 0 vulnerabilities in Elastic Cloud Enterprise . Last year Elastic Cloud Enterprise had 2 security vulnerabilities published. Right now, Elastic Cloud Enterprise is on track to have less security vulnerabilities in 2023 than it did last year.

Year Vulnerabilities Average Score
2023 0 0.00
2022 2 5.90
2021 0 0.00
2020 0 0.00
2019 0 0.00
2018 3 6.23

It may take a day or so for new Elastic Cloud Enterprise vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Elastic Cloud Enterprise Security Vulnerabilities

A flaw was discovered in ECE before 3.1.1

CVE-2022-23716 5.3 - Medium - September 28, 2022

A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster.

Insertion of Sensitive Information into Log File

A flaw was discovered in ECE before 3.4.0

CVE-2022-23715 6.5 - Medium - August 25, 2022

A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or deployment logs in the Logging and Monitoring cluster. The affected APIs are PATCH /api/v1/user and PATCH /deployments/{deployment_id}/elasticsearch/{ref_id}/keystore

Insertion of Sensitive Information into Log File

In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters

CVE-2018-3825 5.9 - Medium - September 19, 2018

In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable across all ECE deployments. If an attacker can connect to ZooKeeper directly they would be able to access configuration information of other tenants if their cluster ID is known.

Insecure Default Initialization of Resource

Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability

CVE-2018-3828 7.5 - High - September 19, 2018

Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would result in encryption keys, passwords, and other security sensitive headers being leaked to the allocator logs. An attacker with access to the logging cluster may obtain leaked credentials and perform authenticated actions using these credentials.

Insertion of Sensitive Information into Log File

In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered

CVE-2018-3829 5.3 - Medium - September 19, 2018

In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an invalid roles token. An attacker with access to the previous runner ID and IP address of the coordinator-host could add a allocator to an existing ECE install to gain access to other clusters data.

Authentication Bypass by Spoofing

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Elastic Cloud Enterprise or by Elastic? Click the Watch button to subscribe.

Elastic
Vendor

subscribe