CVE-2023-46667

HIGH Year: 2023
CVSS v3 Score
8.1
High
Weakness Type
CWE-532
View all →

Vulnerability Description

An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively a threat actor could potentially enrol agents to the clusters and send arbitrary events to Elasticsearch.

Related Vulnerabilities

CVE-2018-19786

HIGH
CVSS:8.1(High)

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being repo...

CWE-5322018

CVE-2018-3827

HIGH
CVSS:8.1(High)

A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin is set to log at TRACE level Azure creden...

CWE-5322018

CVE-2019-11336

HIGH
CVSS:8.1(High)

Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by using the Photo Sharing Plus application to execute a backd...

CWE-5322019

CVE-2021-45103

HIGH
CVSS:8.1(High)

An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. An attacker can access files stored in S3 cloud storage that a user has asked HTCondor to transfer.

CWE-5322021

CVE-2023-22574

HIGH
CVSS:8.1(High)

Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI module. A low-privileged user with permission to read logs on ...

CWE-5322023

CVE-2020-10712

HIGH
CVSS:8.2(High)

A flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry operator allowing an attacker able to gain access to those lo...

CWE-5322020