Description
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Elastic Cloud Enterprise (ECE) | 2.5.0 – ≤ 3.8.1, 4.0.0 – ≤ 4.0.1 | — |