Skip to content
fr Sign in
9.1 Critical

CVE-2025-37729 Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a…

Description

Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.

Affected products and versions

Product Affected versions Fixed in
Elastic Cloud Enterprise (ECE) 4.0 4.0.0 → 4.0.1 No fix stated
Elastic Cloud Enterprise (ECE) 2.5 2.5.0 → 3.8.1 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Elastic Cloud Enterprise (ECE)

The 3 CVEs of Elastic Cloud Enterprise (ECE) →
CVE-2025-37736 Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can… 8.8 High CVE-2018-3825 In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of… Not rated
Track this CVE