CVE-2024-37286

Name of the Vulnerable Software and Affected Versions Elastic APM Server versions prior to 8.14.0

Description The issue concerns the logging of sensitive data by the APM server due to a flaw related to unavailable shards exception. When a bulk index request partially fails, the APM server logs the Elasticsearch response line, which contains the document body, thus effectively logging sensitive information. This can lead to information exposure.

Recommendations For Elastic APM Server versions prior to 8.14.0, upgrade to version 8.14.0 or later to mitigate the risk of sensitive data exposure. As a temporary workaround, consider restricting the logging of Elasticsearch response lines on error to minimize the risk of sensitive information being logged.