5.3 Medium

CVE-2023-31416 Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0

Description

Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment.

Affected products and versions

Product	Affected versions	Fixed in
Elastic Cloud on Kubernetes 2.8	earliest → < 2.8	2.8
elastic_cloud_on_kubernetes 2.8	earliest → < 2.8	2.8

The 2 CVEs of Elastic Cloud on Kubernetes →

CVE-2020-7010 Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator Not rated

Do you use Elastic Cloud on Kubernetes?

Track this CVE Watch Elastic Cloud on Kubernetes Check my SBOMs

www.cveye.io/en/cve/CVE-2023-31416

Timeline

Published October 26, 2023
Last modified September 9, 2024

References

discuss.elastic.co discuss.elastic.co
www.elastic.co www.elastic.co

Track this CVE

CVE-2023-31416 Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0

Description

Affected products and versions

Other CVEs of Elastic Cloud on Kubernetes