CVE-2021-22143

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application error it is possible the headers will not be sanitized before being sent.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200CWE-532

Affected software

VendorProductVersions
ElasticElastic APM .NET Agent>= 1.0.0, < 1.10.0

References

Timeline

Published
Nov 22, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-221446.5In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack wasCVE-2021-221456.5A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrCVE-2021-221467.5All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the defaulCVE-2021-221476.5Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated useCVE-2021-221488.8Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as CVE-2021-221498.8Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alteCVE-2021-22154.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.CVE-2021-221507.2It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml liCVE-2021-221514.3It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could CVE-2021-221525.5A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 CVE-2021-221537.3A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a CVE-2021-221545.3An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1