TI-2024-15495 Aliases CVE-2024-23448 GHSA-8r33-q5j5-rh7g

APM Server Insertion of Sensitive Information into Log File

LOW 34CWE-532Published 2024-02-07 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00671 52nd percentileScored 2026-11-07

Fix Fixed APM Server (Elastic): 8.12.1github.com/elastic/apm-server (Go): 8.12.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Elastic	APM Server	8.12 to before 8.12.1	8.12.1	Patch available	CNA
—	github.com/elastic/apm-server (Go)	before 8.12.1	8.12.1	Patch available	GHSA-8r33-q5j5-rh7g

APM Server VendorElastic Affected 8.12 to before 8.12.1 Fixed in 8.12.1 Patch available CNA
github.com/elastic/apm-server (Go) Vendor— Affected before 8.12.1 Fixed in 8.12.1 Patch available GHSA-8r33-q5j5-rh7g

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:elastic:apm_server::::::::	before 8.12.1	Vulnerable	Elastic

cpe:2.3:a:elastic:apm_server:*:*:*:*:*:*:*:* Versions before 8.12.1 Vulnerable ·Elastic

Remediation

Fix · CNA APM Server (Elastic) Fixed in 8.12.1
Fix · GHSA-8r33-q5j5-rh7g github.com/elastic/apm-server (Go) Fixed in 8.12.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-23448
2026-10-03 Alias added: GHSA-8r33-q5j5-rh7g

References

Advisory 3

Other 1

https://github.com/elastic/apm-server

TI-2023-15038 Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue CVSS 3.1HIGH 7.5
TI-2024-24801 APM Server Insertion of Sensitive Information into Log File CVSS 3.1MEDIUM 6.5
TI-2026-54643 Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences