CVE-2022-23715

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-25 · updated 2026-06-17
Weakness: CWE-532

Description

A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or deployment logs in the Logging and Monitoring cluster. The affected APIs are PATCH /api/v1/user and PATCH /deployments/{deployment_id}/elasticsearch/{ref_id}/keystore

Affected products

Elastic Cloud Enterprise: before 3.4.0 — fixed in 3.4.0

How to fix

Upgrade to a fixed version: Elastic Cloud Enterprise 3.4.0. Check the vendor advisory for mitigations.

References

https://discuss.elastic.co/t/elastic-cloud-enterprise-3-4-0-security-update/312825
https://www.elastic.co/community/security
https://discuss.elastic.co/t/elastic-cloud-enterprise-3-4-0-security-update/312825
https://www.elastic.co/community/security

Get alerted when CVE-2022-23715 or the next vulnerability affects your stack