Aller au contenu
en Se connecter
9.1 Critique

CVE-2025-37729 Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a…

Description

Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.

Produits et versions touchés

Produit Versions touchées Corrigé en
Elastic Cloud Enterprise (ECE) 4.0 4.0.0 → 4.0.1 Pas de correctif indiqué
Elastic Cloud Enterprise (ECE) 2.5 2.5.0 → 3.8.1 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Elastic Cloud Enterprise (ECE)

Les 3 CVE de Elastic Cloud Enterprise (ECE) →
CVE-2025-37736 Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can… 8.8 Élevée CVE-2018-3825 In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of… Non notée
Suivre cette CVE