Back to CVE Browser

CVE-2020-7009

HIGH

8.8

CVSS Severity Score

EPSS Score0.1620%

EPSS Percentile42.09th

PublishedMar 31, 2020

Last ModifiedNov 21, 2024

Vulnerability Description

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

Affected Platforms (CPE)

📦

Elastic

Elasticsearch

>= 6.7.0 and < 6.8.8

📦

Elastic

Elasticsearch

>= 7.0.0 and < 7.6.2

References & Advisories

🔗 https://discuss.elastic.co/t/elastic-stack-6-8-8-and-7-6-2-security-update/225920

🔗 https://security.netapp.com/advisory/ntap-20200403-0004/

🔗 https://www.elastic.co/community/security/

🔗 https://discuss.elastic.co/t/elastic-stack-6-8-8-and-7-6-2-security-update/225920

🔗 https://security.netapp.com/advisory/ntap-20200403-0004/

🔗 https://www.elastic.co/community/security/

Related Vulnerabilities

CVE-2017-126299.8

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of ...

CVE-2015-53779.8

Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport proto...

CVE-2015-14279.8

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox pro...

CVE-2020-150979.1

loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server ...