CVE-2018-3825

5.9MEDIUM

Key Information:

Vendor
Elastic
Status
Elastic Cloud Enterprise (ece)
Vendor
CVE Published:
19 September 2018

Summary

In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable across all ECE deployments. If an attacker can connect to ZooKeeper directly they would be able to access configuration information of other tenants if their cluster ID is known.

Affected Version(s)

Elastic Cloud Enterprise (ECE) before 1.1.4

References

https://www.elastic.co/community/security
x_refsource_CONFIRM
https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.