[MAVEN:GHSA-GFV5-GRX2-9JW2] Improper Privilege Management in Elasticsearch

Severity High

Affected Packages 2

Fixed Packages 2

CVEs 1

Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

Package	Affected Version
pkg:maven/org.elasticsearch/elasticsearch	>= 7.0.0, <= 7.6.1
pkg:maven/org.elasticsearch/elasticsearch	>= 6.7.0, <= 6.8.7

Package	Fixed Version
pkg:maven/org.elasticsearch/elasticsearch	= 7.6.2
pkg:maven/org.elasticsearch/elasticsearch	= 6.8.8

ID: MAVEN:GHSA-GFV5-GRX2-9JW2
Severity: high
URL: https://github.com/advisories/GHSA-gfv5-grx2-9jw2
Published: 2022-05-24T17:13:01
(2 years ago)
Modified: 2023-01-27T05:02:28
(20 months ago)
Rights: Maven Security Team

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2020-7009
			https://discuss.elastic.co/t/elastic-stack-6-8-8-and-7-6-2-security-update/225920
			https://security.netapp.com/advisory/ntap-20200403-0004/
			https://www.elastic.co/community/security/
			https://github.com/advisories/GHSA-gfv5-grx2-9jw2

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.elasticsearch/elasticsearch	org.elasticsearch	elasticsearch	>= 7.0.0 <= 7.6.1
Fixed	pkg:maven/org.elasticsearch/elasticsearch	org.elasticsearch	elasticsearch	= 7.6.2
Affected	pkg:maven/org.elasticsearch/elasticsearch	org.elasticsearch	elasticsearch	>= 6.7.0 <= 6.8.7
Fixed	pkg:maven/org.elasticsearch/elasticsearch	org.elasticsearch	elasticsearch	= 6.8.8

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date