CVE-2020-7009
High
Description
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
SeverityHigh
CVSS8.8
Exploit probability80. percentile1.9%
Product
Elasticsearch
PublishedMar 31, 2020
First seenMar 31, 2020
Weakness typeCWE-266CWE-266
How to fix
Update
- elastic elasticsearch6.8.8, 7.6.2 or later
- org.elasticsearch:elasticsearch6.8.8, 7.6.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elastic elasticsearch | 6.7.0 ≤ v < 6.8.8, 7.0.0 ≤ v < 7.6.2 | 6.8.8, 7.6.2 |
| org.elasticsearch:elasticsearchMaven | 6.7.0 ≤ v < 6.8.8, 7.0.0 ≤ v < 7.6.2 | 6.8.8, 7.6.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.