CVE-2018-3825CWE-321

CVE-2018-3825: falha em Elastic Cloud Enterprise (ECE)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Elastic Cloud Enterprise

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 0.7%
In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable across all ECE deployments. If an attacker can connect to ZooKeeper directly they would be able to access configuration information of other tenants if their cluster ID is known.
Produtos afetados
Elastic · Elastic Cloud Enterprise (ECE)
CVEs relacionadas — Elastic Cloud Enterprise (ECE)

No mesmo produto, das mais perigosas para as menos.

CVE-2025-37729CRITICALElastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template EngineEPSS 0.7%CVE-2025-37736HIGHElastic Cloud Enterprise Improper AuthorizationEPSS 0.4%