Description (CNA)
Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Elastic / Elastic Cloud on Kubernetes | affected <2.8 |
CWE
CWE-200
References
- https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-eck-2-8-security-update/343854
- https://www.elastic.co/community/security
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.