CVE-2022-23715CWE-532

CVE-2022-23715: vulnerability in Elastic Cloud Enterprise

Published · Updated

Follow this CVE+ Monitor Elastic Cloud Enterprise

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.8%
A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or deployment logs in the Logging and Monitoring cluster. The affected APIs are PATCH /api/v1/user and PATCH /deployments/{deployment_id}/elasticsearch/{ref_id}/keystore
Affected products
Elastic · Elastic Cloud Enterprise
Related CVEs — Elastic Cloud Enterprise

In the same product, most dangerous first.

CVE-2018-3829—CVE-2018-3829EPSS 0.9%CVE-2022-23716MEDIUMCVE-2022-23716EPSS 0.7%CVE-2024-37282HIGHCVE-2024-37282EPSS 0.6%CVE-2018-3828—CVE-2018-3828EPSS 0.6%CVE-2017-8444—CVE-2017-8444EPSS 0.6%CVE-2026-115709HIGHImproper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data LossEPSS 0.3%