CVE-2021-22143 json
Elastic APM .NET Agent information disclosure
published 2023-11-22 2 y ago modified 2026-06-17 4 mo ago also GHSA-hx93-gc73-5rpr , EUVD-2023-2978
- cvss
- 2.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application error it is possible the headers will not be sanitized before being sent.
Patch / fix
- nuget Elastic.Apm 1.10.0
- Elastic Elastic APM .NET Agent 1.10.0
- github.com/elastic/apm-agent-dotnet@c2b519a commit
- github.com/elastic/apm-agent-dotnet#1286 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.1 | CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 2.1 | CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Elastic.Apm | <1.10.0 |
1.10.0 |
Affected products
- Elastic Elastic APM .NET Agent
Classification
References
-
github.com
/elastic/apm-agent-dotnet/pull/1286
web
-
github.com
/elastic/apm-agent-dotnet/commit/c2b519aaa0fe5e5044b736cfec695342f124bf30
web
-
discuss.elastic.co
/t/elastic-apm-net-agent-1-10-0-security-update/274668
web, vendor-advisory
-
elastic.co
/community/security
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-22143
advisory
-
github.com
/elastic/apm-agent-dotnet
package
Sources
- CVE List CVE-2021-22143
- GitHub Advisory GHSA-hx93-gc73-5rpr
- NVD CVE-2021-22143
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.