CVE-2018-3829CWE-285

CVE-2018-3829: vulnerability in Elastic Cloud Enterprise

Published · Updated

Follow this CVE+ Monitor Elastic Cloud Enterprise

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.9%
In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an invalid roles token. An attacker with access to the previous runner ID and IP address of the coordinator-host could add a allocator to an existing ECE install to gain access to other clusters data.
Affected products
Elastic · Elastic Cloud Enterprise
Related CVEs — Elastic Cloud Enterprise

In the same product, most dangerous first.

CVE-2022-23715—CVE-2022-23715EPSS 0.8%CVE-2022-23716MEDIUMCVE-2022-23716EPSS 0.7%CVE-2024-37282HIGHCVE-2024-37282EPSS 0.6%CVE-2018-3828—CVE-2018-3828EPSS 0.6%CVE-2017-8444—CVE-2017-8444EPSS 0.6%CVE-2026-115709HIGHImproper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data LossEPSS 0.3%