CVE-2025-25013

MEDIUM

Elastic Defend 8.0.0-8.17.2 - Sensitive Information Exposure via Unfiltered Environment Variables

Title source: llm

Description

Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack.

References (1)

Core 1

Core References

Various Sources

https://discuss.elastic.co/t/elastic-defend-8-17-3-security-update-esa-2025-05/376921

Scores

CVSS v3 6.5

EPSS 0.0029

EPSS Percentile 20.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-532

Status published

Products (1)

Elastic/Elastic Defend 8.0.0 - 8.17.3

Published Apr 08, 2025

Tracked Since Feb 18, 2026