Predictable Master Encryption Key Vulnerability in Elastic Cloud Enterprise
CVE-2018-3825
5.9MEDIUM
Key Information:
- Vendor
- Elastic
- Vendor
- CVE Published:
- 19 September 2018
Summary
In versions of Elastic Cloud Enterprise prior to 1.1.4, a predictable default master encryption key is employed for granting ZooKeeper access to Elasticsearch clusters. If this master key is not overridden, it remains the same across different deployments. An attacker with direct access to ZooKeeper could exploit this weakness to gain unauthorized access to sensitive configuration data from other tenant clusters, given that they know the cluster ID.
Affected Version(s)
Elastic Cloud Enterprise (ECE) before 1.1.4
References
CVSS V3.1
Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved