Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2020-7009

Опубликовано: 31 мар. 2020
Источник: redhat
CVSS3: 8.8

Описание

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

Отчет

OpenShift Container Platform 4.x and 3.11 use Elasticsearch 5.6 which does not have the API Keys feature.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Decision Manager 7elasticsearchNot affected
Red Hat Fuse 7elasticsearchNot affected
Red Hat JBoss Fuse 6elasticsearchNot affected
Red Hat OpenShift Container Platform 3.11elasticsearchNot affected
Red Hat OpenShift Container Platform 4elasticsearchNot affected
Red Hat Process Automation 7elasticsearchNot affected

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-266
https://bugzilla.redhat.com/show_bug.cgi?id=1821240elasticsearch: Generating API keys with specific steps could result in generating API key with elevated privileges

8.8 High

CVSS3

Связанные уязвимости

CVSS3: 8.8
ubuntu
почти 6 лет назад

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

CVSS3: 8.8
nvd
почти 6 лет назад

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

CVSS3: 8.8
msrc
около 4 лет назад

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

CVSS3: 8.8
debian
почти 6 лет назад

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 ...

CVSS3: 8.8
github
больше 3 лет назад

Improper Privilege Management in Elasticsearch

8.8 High

CVSS3