Apm Server

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:elastic:apm_server:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorElastic (1d0b8d2a-fd47-5b20-b005-34326f9bd037)
ProductApm Server (0349b51c-b2fa-5c4a-81d3-303878a38311)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/elastic/apm-server purl2cpe 2026-06-01 10:15:14.297623
pkg:golang/github.com/elastic/apm-server purl2cpe 2026-06-01 10:15:14.297625

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-0712 vulnerable 2026-06-08 07:02:25.232177 APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation (LPE) when using the Windows Installer
HIGH (7)
An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.
Published: 2025-07-30T00:12:43.639Z
Updated: 2025-07-30T14:06:16.977Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-37286 vulnerable 2026-06-08 06:39:47.056335 APM Server Insertion of Sensitive Information into Log File
MEDIUM (5.7)
APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable_shards_exception for a specific document, since the ES response line contains the document body, and that APM server logs the ES response line on error, the document is effectively logged.
Published: 2024-08-03T15:16:22.700Z
Updated: 2024-09-03T15:36:33.784Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-37286 not_vulnerable 2026-06-08 06:39:47.056276 APM Server Insertion of Sensitive Information into Log File
MEDIUM (5.7)
APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable_shards_exception for a specific document, since the ES response line contains the document body, and that APM server logs the ES response line on error, the document is effectively logged.
Published: 2024-08-03T15:16:22.700Z
Updated: 2024-09-03T15:36:33.784Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-23448 vulnerable 2026-06-08 06:29:39.746567 APM Server Insertion of Sensitive Information into Log File
MEDIUM (5.7)
An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.
Published: 2024-02-07T21:37:45.908Z
Updated: 2024-08-01T23:06:24.582Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-11994 vulnerable 2026-06-08 06:23:50.870113 APM Server Insertion of Sensitive Information into Log File
MEDIUM (5.7)
APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclose sensitive information in APM Server error logs.
Published: 2025-05-01T13:06:54.194Z
Updated: 2025-05-01T15:32:54.220Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-31421 vulnerable 2026-06-08 06:04:43.102466 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-31416 not_vulnerable 2026-06-08 06:04:43.094867 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.