60
CVE-2025-37729
—CVSS 3.1
7.2 high
EPSS
<1%p46
Published
()
Modified
Description
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.
- Vendors
- elastic
- Products
- elastic cloud enterprise
- Weakness
- CWE-1336
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H