API Key Misconfiguration in Elastic Enterprise Search App Search by Elastic
CVE-2021-22148
8.8HIGH
What is CVE-2021-22148?
The Elastic Enterprise Search App Search was found to have a misconfiguration related to API keys, allowing less privileged users to access unauthorized engines. The vulnerability arises from API keys not being restricted to their corresponding engines, potentially exposing sensitive data and functionality to users who should not have access. This security issue emphasizes the importance of proper access controls and configuration management in software applications.
Affected Version(s)
Elastic Enterprise Search before 7.14.0