CVE-2021-22133
Published Feb 10, 2021
Last updated 4 years ago
Overview
- Description
- The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.
- Source
- bressers@elastic.co
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 2.4
- Impact score
- 1.4
- Exploitability score
- 0.9
- Vector string
- CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- Severity
- LOW
CVSS 2.0
- Type
- Primary
- Base score
- 2.7
- Impact score
- 2.9
- Exploitability score
- 5.1
- Vector string
- AV:A/AC:L/Au:S/C:P/I:N/A:N
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elastic:apm_agent:*:*:*:*:*:go:*:*",
"vulnerable": true,
"matchCriteriaId": "8220CFD2-D742-4E7B-9B2E-26A5FD413453",
"versionEndExcluding": "1.11.0"
}
],
"operator": "OR"
}
]
}
]