Skip to content
fr Sign in
Not rated

CVE-2022-23715 A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user…

Description

A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or deployment logs in the Logging and Monitoring cluster. The affected APIs are PATCH /api/v1/user and PATCH /deployments/{deployment_id}/elasticsearch/{ref_id}/keystore

Affected products and versions

Product Affected versions Fixed in
Elastic Cloud Enterprise Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Elastic Cloud Enterprise

The 13 CVEs of Elastic Cloud Enterprise →
CVE-2026-115713 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to… 7.5 High CVE-2026-115712 Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of… 4.3 Medium CVE-2026-115711 Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise… 6.4 Medium CVE-2026-115709 Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to… 8.2 High
Track this CVE