CVE-2018-3828

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-19 · updated 2026-06-17
Weakness: CWE-532

Description

Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would result in encryption keys, passwords, and other security sensitive headers being leaked to the allocator logs. An attacker with access to the logging cluster may obtain leaked credentials and perform authenticated actions using these credentials.

Affected products

Elastic Cloud Enterprise: before 1.1.4 — fixed in 1.1.4

How to fix

Upgrade to a fixed version: Elastic Cloud Enterprise 1.1.4. Check the vendor advisory for mitigations.

References

https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778
https://www.elastic.co/community/security
https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778
https://www.elastic.co/community/security

Get alerted when CVE-2018-3828 or the next vulnerability affects your stack