Riskcovery

CVE-2023-31421

Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue

State
Published
Severity
5.9 Medium
Published
Oct 26, 2023
Updated
Aug 2, 2024
Reserved
Apr 27, 2023

Read the record on cve.org

Description

It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected.

Scores

CVSSScoreVectorSource
3.15.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nelastic

Weaknesses

  • CWE-295 Improper Certificate Validation

Affected Products

ProductVersions
BeatsElastic
  • 8.0.0, 8.9.2Affected
Elastic AgentElastic
  • 8.0.0, 8.9.2Affected
APM ServerElastic
  • 8.0.0, 8.9.2Affected
Fleet ServerElastic
  • 8.0.0, 8.9.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.