cveboard RSS feed

CVE-2023-31421

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2023
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue

It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Beats

Vendor
Elastic
Product
Beats
Platforms
Unknown
Default status
unaffected
Beats · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
8.0.0, 8.9.2affectedUnavailableUnavailableUnavailableNone listed

Elastic Agent

Vendor
Elastic
Product
Elastic Agent
Platforms
Unknown
Default status
unaffected
Elastic Agent · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
8.0.0, 8.9.2affectedUnavailableUnavailableUnavailableNone listed

APM Server

Vendor
Elastic
Product
APM Server
Platforms
Unknown
Default status
unaffected
APM Server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
8.0.0, 8.9.2affectedUnavailableUnavailableUnavailableNone listed

Fleet Server

Vendor
Elastic
Product
Fleet Server
Platforms
Unknown
Default status
unaffected
Fleet Server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
8.0.0, 8.9.2affectedUnavailableUnavailableUnavailableNone listed