FKIE_CVE-2023-31416

Vulnerability from fkie_nvd - Published: 2023-10-26 19:15 - Updated: 2026-06-17 05:56
Severity
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment.
References
security@elastic.cohttps://discuss.elastic.co/t/elastic-cloud-on-kubernetes-eck-2-8-security-update/343854Vendor Advisory
security@elastic.cohttps://www.elastic.co/community/securityNot Applicable
af854a3a-2127-422b-91ae-364da2661108https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-eck-2-8-security-update/343854Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.elastic.co/community/securityNot Applicable
Impacted products
Vendor Product Version
elastic elastic_cloud_on_kubernetes *
elastic apm_server *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Elastic Cloud on Kubernetes",
          "vendor": "Elastic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c2.8"
            }
          ]
        }
      ],
      "source": "security@elastic.co"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "elastic_cloud_on_kubernetes",
          "vendor": "elastic",
          "versions": [
            {
              "lessThan": "2.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B6C7991-B614-4A17-8552-B8FF1DC57112",
              "versionEndExcluding": "2.8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elastic:apm_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "28FB2BF9-AB9D-4518-B4D4-2AC4BD3233D8",
              "versionStartIncluding": "8.0.0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Secret token configuration is never applied when using ECK \u003c2.8 with APM Server \u003e=8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment."
    },
    {
      "lang": "es",
      "value": "La configuraci\u00f3n del token secreto nunca se aplica cuando se usa ECK \u0026lt;2.8 con APM Server\u0026gt;=8.0. Esto podr\u00eda dar lugar a que se acepten solicitudes an\u00f3nimas a un servidor APM y que los datos se ingieran en esta implementaci\u00f3n de APM."
    }
  ],
  "id": "CVE-2023-31416",
  "lastModified": "2026-06-17T05:56:54.153",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security@elastic.co",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-31416",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-09-09T16:15:15.504800Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-10-26T19:15:45.270",
  "references": [
    {
      "source": "security@elastic.co",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-eck-2-8-security-update/343854"
    },
    {
      "source": "security@elastic.co",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.elastic.co/community/security"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-eck-2-8-security-update/343854"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.elastic.co/community/security"
    }
  ],
  "sourceIdentifier": "security@elastic.co",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security@elastic.co",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.