High severity · published Feb 7, 2024
CVE-2024-23448
APM Server Insertion of Sensitive Information into Log File
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
APM Server · Elastic
8.12 before 8.12.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23448
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23448
Vendor Advisory
https://discuss.elastic.co/t/apm-server-8-12-1-security-update-esa-2024-03/352688
Vendor Advisory
https://www.elastic.co/community/security
More from APM Server
7.5
CVE-2023-31421
Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue
7.0
CVE-2025-0712
APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer
6.5
CVE-2024-37286
APM Server Insertion of Sensitive Information into Log File
5.7
CVE-2024-11994
APM Server Insertion of Sensitive Information into Log File
4.9
CVE-2026-78594
Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service