What is CVE-2021-22133?

CVE-2021-22133 is a low-severity vulnerability in Elastic Apm Agent, classified under Insertion of Sensitive Information into Log File. CVSS score: 2.4/10. Published 2021-02-10.

How severe is CVE-2021-22133?

Low severity. CVSS v3 base score is 2.4 out of 10.

Information disclosure in Elastic Apm Agent

CVE-2021-22133

The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.

EPSS: 0.005 (41.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 2.4 (Low). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.

Affected products

Elastic Apm_agent
Elastic Apm Agent For Go — versions before 1.11.0

Weakness classification (CWE)

CWE-532 — Insertion of Sensitive Information into Log File

References

security@elastic.co (x_refsource_MISC, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2021-22133?: CVE-2021-22133 is a low-severity vulnerability in Elastic Apm Agent, classified under Insertion of Sensitive Information into Log File. CVSS score: 2.4/10. Published 2021-02-10.
How severe is CVE-2021-22133?: Low severity. CVSS v3 base score is 2.4 out of 10.