Read the docs
TI-2023-27292 Aliases CVE-2023-49922GHSA-hj4r-2c9c-29h3

Beats Insertion of Sensitive Information into Log File

Priority LOW 31CWE-532Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Beats or Elastic Agent attempted to ingest, this could lead to the insertion of sensitive or private information in the Beats or Elastic Agent logs. Elastic has released 8.11.3 and 7.17.16 that prevents this issue by limiting these types of logs to DEBUG level logging, which is disabled by default.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00666 52nd percentileScored 2026-11-07
Fix Fixed Beats (Elastic): 7.17.16, 8.11.3github.com/elastic/beats/v7 (Go): 7.17.16+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ElasticBeats7.0.0, 8.0.0 to before 7.17.16, 8.11.37.17.16, 8.11.3Patch availableCNA
—github.com/elastic/beats/v7 (Go)7.0.0 to before 7.17.167.17.16Patch availableGHSA-hj4r-2c9c-29h3
—github.com/elastic/beats (Go)8.0.0 to before 8.11.38.11.3Patch availableGHSA-hj4r-2c9c-29h3
—github.com/elastic/beats (Go)7.0.0 to before 7.17.167.17.16Patch availableGHSA-hj4r-2c9c-29h3
  • Beats VendorElastic Affected 7.0.0, 8.0.0 to before 7.17.16, 8.11.3 Fixed in 7.17.16, 8.11.3 Patch available CNA
  • github.com/elastic/beats/v7 (Go) Vendor— Affected 7.0.0 to before 7.17.16 Fixed in 7.17.16 Patch available GHSA-hj4r-2c9c-29h3
  • github.com/elastic/beats (Go) Vendor— Affected 8.0.0 to before 8.11.3 Fixed in 8.11.3 Patch available GHSA-hj4r-2c9c-29h3
  • github.com/elastic/beats (Go) Vendor— Affected 7.0.0 to before 7.17.16 Fixed in 7.17.16 Patch available GHSA-hj4r-2c9c-29h3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elastic:elastic_beats:*:*:*:*:*:*:*:*7.0.0 to before 7.17.16; 8.0.0 to before 8.11.3VulnerableElastic
  • cpe:2.3:a:elastic:elastic_beats:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.17.16; 8.0.0 to before 8.11.3 Vulnerable ·Elastic

Remediation

  • Fix · CNA Beats (Elastic) Fixed in 7.17.16, 8.11.3
  • Fix · GHSA-hj4r-2c9c-29h3 github.com/elastic/beats/v7 (Go) Fixed in 7.17.16 Advisory →
  • Fix · GHSA-hj4r-2c9c-29h3 github.com/elastic/beats (Go) Fixed in 8.11.3 Advisory →
  • Fix · GHSA-hj4r-2c9c-29h3 github.com/elastic/beats (Go) Fixed in 7.17.16 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49922
  2. 2026-10-03 Alias added: GHSA-hj4r-2c9c-29h3

References

Advisory 2

Other 2

  • TI-2023-15038 Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences