Skip to content
ElasticsearchGHSA-gfv5-grx2-9jw2

Improper Privilege Management in Elasticsearch

High8.8CVE-2020-7009 · Published May 24, 2022 · updated Feb 21, 2024

GitHub advisory

Affected versions

PackageAffectedFixed in
org.elasticsearch:elasticsearch
Maven
>= 6.7.0, < 6.8.86.8.8
>= 7.0.0, < 7.6.27.6.2
Details and references

Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-266, CWE-269
Also known as
BIT-elasticsearch-2020-7009, CVE-2020-7009

More Elasticsearch advisories

All Elasticsearch
DateAdvisory
May 242022Concurrent Execution using Shared Resource with Improper Synchronization in Elasticsearch
CVE-2019-7614Medium5.9fixed in 6.8.2, 7.2.1
May 242022Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
CVE-2019-7619Medium5.3fixed in 6.8.4, 7.4.0
May 242022Improper privilege management in elasticsearch
CVE-2020-7019Medium6.5fixed in 6.8.12, 7.9.0
May 242022Insertion of Sensitive Information into Log File in Elasticsearch
CVE-2020-7021Medium4.9fixed in 6.8.14, 7.10.0
May 242022Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
CVE-2021-22137Medium5.3fixed in 6.8.15, 7.11.2
May 172022Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch
CVE-2015-3337Mediumfixed in 1.4.5, 1.5.2

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.