What is CVE-2021-22143?

CVE-2021-22143 is a low-severity vulnerability in Elastic Apm .Net Agent, classified under Information Disclosure. CVSS score: 2.1/10. Published 2023-11-22.

How severe is CVE-2021-22143?

Low severity. CVSS v3 base score is 2.1 out of 10.

Information disclosure in Elastic Apm .Net Agent

CVE-2021-22143

The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application error it is possible the headers will not be sanitized before being sent.

Vulnerability class: Information Disclosure

EPSS: 0.006 (45.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 2.1 (Low). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N.

Affected products

Elastic Apm_.net_agent
Elastic Apm .Net Agent — versions 1.0.0

Weakness classification (CWE)

References

security@elastic.co (Vendor Advisory)
security@elastic.co (Vendor Advisory)

Frequently asked questions

What is CVE-2021-22143?: CVE-2021-22143 is a low-severity vulnerability in Elastic Apm .Net Agent, classified under Information Disclosure. CVSS score: 2.1/10. Published 2023-11-22.
How severe is CVE-2021-22143?: Low severity. CVSS v3 base score is 2.1 out of 10.