Predictable Master Encryption Key Vulnerability in Elastic Cloud Enterprise
CVE-2018-3825

5.9MEDIUM

Key Information:

Vendor

Elastic
Status
Elastic Cloud Enterprise (ece)
Vendor
CVE Published:
19 September 2018

What is CVE-2018-3825?

In versions of Elastic Cloud Enterprise prior to 1.1.4, a predictable default master encryption key is employed for granting ZooKeeper access to Elasticsearch clusters. If this master key is not overridden, it remains the same across different deployments. An attacker with direct access to ZooKeeper could exploit this weakness to gain unauthorized access to sensitive configuration data from other tenant clusters, given that they know the cluster ID.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Elastic Cloud Enterprise (ECE) before 1.1.4

References

https://www.elastic.co/community/security
x_refsource_CONFIRM
https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.