What is CVE-2023-49922?

CVE-2023-49922 is a medium-severity vulnerability in Elastic Beats, classified under Insertion of Sensitive Information into Log File. CVSS score: 6.8/10. Published 2023-12-12.

How severe is CVE-2023-49922?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Information disclosure in Elastic Beats

CVE-2023-49922

An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending…

EPSS: 0.006 (43.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

Affected products

Elastic Beats — versions 7.0.0, 8.0.0
Elastic Elastic_beats

Weakness classification (CWE)

CWE-532 — Insertion of Sensitive Information into Log File

References

security@elastic.co (Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2023-49922?: CVE-2023-49922 is a medium-severity vulnerability in Elastic Beats, classified under Insertion of Sensitive Information into Log File. CVSS score: 6.8/10. Published 2023-12-12.
How severe is CVE-2023-49922?: Medium severity. CVSS v3 base score is 6.8 out of 10.