CVEvulnerability

CVE-2018-3825

5.9 MEDIUM Published 2018-09-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-09-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-1188, CWE-321

Description

In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable across all ECE deployments. If an attacker can connect to ZooKeeper directly they would be able to access configuration information of other tenants if their cluster ID is known.

Affected configurations

• elastic elastic cloud enterprise (< 1.1.4)

Related

Weakness · CWE (2)

  • CWE-1188 Initialization of a Resource with an Insecure Default weakness
  • CWE-321 Use of Hard-coded Cryptographic Key weakness

Referenced by CWE · observed example (3)

  • CWE-1391 Use of Weak Credentials weakness
  • CWE-1392 Use of Default Credentials weakness
  • CWE-1394 Use of Default Cryptographic Key weakness

References