Weak Random Number Generator in Elastic Cloud on Kubernetes by Elastic
CVE-2020-7010
7.5HIGH
Summary
Prior to version 1.1.0, Elastic Cloud on Kubernetes (ECK) employs a weak random number generator for password creation. This flaw can be exploited by an attacker who knows when the Elastic Stack cluster was deployed, significantly increasing the likelihood of successfully brute-forcing the Elasticsearch credentials generated during the deployment process.
Affected Version(s)
Elastic Cloud on Kubernetes before 1.1.0
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved