CVE-2024-14047

Winlogbeat's Windows installer placed runtime files in a directory writable by unprivileged users, creating an improper link-resolution issue (CWE-59). A low-privileged attacker who already has access to the host can pre-position malicious filesystem links so that a subsequent elevated Winlogbeat operation writes to or deletes arbitrary files. Successful exploitation results in denial of service, with high integrity and availability impact but no confidentiality impact per the CVSS 3.1 score of 7.1. Organizations running Winlogbeat on Windows hosts installed via the Windows installer are affected. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates the 30-day exploitation probability at about 0.1%.

What to do: Consult Elastic's security advisory for CVE-2024-14047 to identify the affected Windows installer versions and upgrade Winlogbeat to a fixed release. In the interim, check that the Winlogbeat installation directory and its runtime files are not writable by unprivileged users and restrict local access on hosts running it, watching for unexpected file deletions.