Elevated Privileges Granted Through API Key Reuse

CVE-2024-37282

Summary

A security issue has been identified within Elastic Cloud Enterprise, where an API key initially created with limited privileges can be exploited to generate new API keys with elevated privileges. This vulnerability can potentially allow unauthorized access to sensitive operations and resources, posing significant risks to data integrity and security. Organizations utilizing Elastic Cloud Enterprise are advised to take immediate steps to review their key management practices and apply necessary updates or patches to mitigate this risk.

References