[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOfkp9fTrR4A9MBqU91tIxkvf3YvHQ0-1qYgGIHz4NAk":3,"g5a-risk:CVE-2018-3825":114},{"success":4,"data":5,"meta":112},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":38,"epssPercentile":15,"epssTimeSeries":39,"severity":40,"affectedProducts":41,"affectedProductsCount":47,"references":48,"referencesCount":57,"weaknesses":58,"weaknessesCount":57,"isActivelyExploited":74,"cisaInfo":15,"otxData":15,"relatedBlogPosts":75,"seoMetadata":76,"configurations":101,"relatedVendorCves":110,"notableEvents":111},"CVE-2018-3825","What is CVE-2018-3825?","In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable across all ECE deployments. If an attacker can connect to ZooKeeper directly they would be able to access configuration information of other tenants if their cluster ID is known.","In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearc...","2018-09-19T19:29:00.5","2019-10-09T23:40:40.233",5.9,"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":16,"CVSSMetricV2":29,"CVSSMetricV40":15},null,[17],{"Source":18,"Type":19,"CVSSData":20,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":21,"VectorString":13,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":23,"IntegrityImpact":24,"AvailabilityImpact":24,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":15,"RemediationLevel":15,"ReportConfidence":15,"TemporalScore":15,"TemporalSeverity":15,"ConfidentialityRequirement":15,"IntegrityRequirement":15,"AvailabilityRequirement":15,"ModifiedAttackVector":15,"ModifiedAttackComplexity":15,"ModifiedPrivilegesRequired":15,"ModifiedUserInteraction":15,"ModifiedScope":15,"ModifiedConfidentialityImpact":15,"ModifiedIntegrityImpact":15,"ModifiedAvailabilityImpact":15,"EnvironmentalScore":15,"EnvironmentalSeverity":15},"3.0","NETWORK","HIGH","NONE","UNCHANGED","MEDIUM",2.2,3.6,[30],{"Source":18,"Type":19,"CVSSData":31,"BaseSeverity":26,"ExploitabilityScore":36,"ImpactScore":37,"ACInsufInfo":15,"ObtainAllPrivilege":15,"ObtainUserPrivilege":15,"ObtainOtherPrivilege":15,"UserInteractionRequired":15},{"Version":32,"VectorString":33,"AccessVector":22,"AccessComplexity":26,"Authentication":24,"ConfidentialityImpact":34,"IntegrityImpact":24,"AvailabilityImpact":24,"BaseScore":35,"BaseSeverity":15,"Exploitability":15,"RemediationLevel":15,"ReportConfidence":15,"TemporalScore":15,"CollateralDamagePotential":15,"TargetDistribution":15,"ConfidentialityRequirement":15,"IntegrityRequirement":15,"AvailabilityRequirement":15,"EnvironmentalScore":15},"2.0","AV:N\u002FAC:M\u002FAu:N\u002FC:P\u002FI:N\u002FA:N","PARTIAL",4.3,8.6,2.9,0.00653,[38,38,38,38,38,38,38],"Medium",[42],{"vendor":43,"product":44,"version":45,"criteria":46,"vulnerable":4},"elastic","elastic_cloud_enterprise","*","cpe:2.3:a:elastic:elastic_cloud_enterprise:*:*:*:*:*:*:*:*",1,[49,54],{"url":50,"source":51,"tags":52},"https:\u002F\u002Fdiscuss.elastic.co\u002Ft\u002Felastic-cloud-enterprise-1-1-4-security-update\u002F135778","Elastic",[53],"Vendor Advisory",{"url":55,"source":51,"tags":56},"https:\u002F\u002Fwww.elastic.co\u002Fcommunity\u002Fsecurity",[53],2,[59,67],{"id":60,"name":61,"description":62,"extendedDescription":63,"status":64,"abstraction":65,"structure":66},"CWE-1188","Initialization of a Resource with an Insecure Default","The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.","Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator can (or should) change the default value.  However, this ease-of-use comes at a cost when the default is insecure and the administrator does not change it.","Incomplete","Base","Simple",{"id":68,"name":69,"description":70,"extendedDescription":71,"status":72,"abstraction":73,"structure":66},"CWE-321","Use of Hard-coded Cryptographic Key","The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.","","Draft","Variant",false,[],{"title":77,"metaDescription":78,"keywords":79,"canonicalUrl":80,"structuredData":81},"What is CVE-2018-3825? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2018-3825, a medium severity cyber security vulnerability from 2018. In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 ...","CVE-2018-3825, CVE-2018-3825 vulnerability, CVE-2018-3825 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2018, CVSS score, exploit, patch, remediation, elastic security, elastic_cloud_enterprise vulnerability","\u002Fwhat-is\u002Fcve-2018-3825",{"@context":82,"@type":83,"headline":77,"description":78,"datePublished":10,"dateModified":11,"author":84,"publisher":88,"about":92,"mainEntityOfPage":96,"articleSection":99,"keywords":100},"https:\u002F\u002Fschema.org","TechArticle",{"@type":85,"name":86,"url":87},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":85,"name":86,"url":87,"logo":89},{"@type":90,"url":91},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":93,"name":6,"description":94,"additionalType":95},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":97,"@id":98},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2018-3825","Cybersecurity","CVE-2018-3825, CVE-2018-3825 vulnerability, CVE-2018-3825 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[102],{"Operator":15,"Negate":15,"Nodes":103},[104],{"Operator":105,"Negate":15,"CPEMatch":106},"OR",[107],{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":108,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":109,"VersionEndIncluding":15},"BBE5D901-05D3-4C30-BFCC-764132574714","1.1.4",[],[],{"lastModified":11,"cacheTime":113,"version":32},1792260438685,{"score":115,"band":116,"action":117,"scoredAt":118},20,"Low","Monitor","2026-10-16T06:44:52.881723+00:00"]