CVE-2023-49922

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-49922
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49922.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-49922
Aliases
Related
Published
2023-12-12T19:15:08.307Z
Modified
2026-03-14T12:15:47.392114Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Beats or Elastic Agent attempted to ingest, this could lead to the insertion of sensitive or private information in the Beats or Elastic Agent logs. Elastic has released 8.11.3 and 7.17.16 that prevents this issue by limiting these types of logs to DEBUG level logging, which is disabled by default.

References

Affected packages

Git /

Affected ranges

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49922.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "7.0.0"
            },
            {
                "fixed": "7.17.16"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "8.0.0"
            },
            {
                "fixed": "8.11.3"
            }
        ]
    }
]