AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ElasticsearchGHSA-gfv5-grx2-9jw2

Improper Privilege Management in Elasticsearch

Elasticsearch

CVE-2020-7009 · Published May 24, 2022 · updated Feb 21, 2024

High8.8
Fix: upgrade to 6.8.8 or later (2 fixed versions below)
GitHub advisory

Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

Affected versions

PackageAffectedFixed in
org.elasticsearch:elasticsearch
Maven
>= 6.7.0, < 6.8.86.8.8
>= 7.0.0, < 7.6.27.6.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-266, CWE-269
Also known as
BIT-elasticsearch-2020-7009, CVE-2020-7009

More Elasticsearch advisories

All Elasticsearch
Medium 5.3May 24, 2022Exposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2021-22137fixed in 6.8.15 +1Medium 4.9May 24, 2022Insertion of Sensitive Information into Log File in ElasticsearchCVE-2020-7021fixed in 6.8.14 +1Medium 6.5May 24, 2022Improper privilege management in elasticsearchCVE-2020-7019fixed in 6.8.12 +1Medium 5.3May 24, 2022Exposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2019-7619fixed in 6.8.4 +1Medium 5.9May 24, 2022Concurrent Execution using Shared Resource with Improper Synchronization in ElasticsearchCVE-2019-7614fixed in 6.8.2 +1MediumMay 17, 2022Improper Limitation of a Pathname to a Restricted Directory in ElasticsearchCVE-2015-3337fixed in 1.4.5 +1