Predictable Master Encryption Key Vulnerability in Elastic Cloud Enterprise
CVE-2018-3825

5.9MEDIUM

Key Information:

Vendor
Elastic
Vendor
CVE Published:
19 September 2018

Summary

In versions of Elastic Cloud Enterprise prior to 1.1.4, a predictable default master encryption key is employed for granting ZooKeeper access to Elasticsearch clusters. If this master key is not overridden, it remains the same across different deployments. An attacker with direct access to ZooKeeper could exploit this weakness to gain unauthorized access to sensitive configuration data from other tenant clusters, given that they know the cluster ID.

Affected Version(s)

Elastic Cloud Enterprise (ECE) before 1.1.4

References

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.