Elasticsearch privilege escalation
CVE-2021-37937

5.9MEDIUM

Key Information:

Vendor

Elastic
Status
Elasticsearch
Vendor
CVE Published:
22 November 2023

What is CVE-2021-37937?

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.

Affected Version(s)

Elasticsearch 7.13.0 < 7.14.0

References

https://discuss.elastic.co/t/elastic-stack-7-14-1-securit...
https://www.elastic.co/community/security

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.