CVE-2020-7018
High
Description
Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the �developer� role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same permissions of the App Search administrator.
SeverityHigh
CVSS8.8
Exploit probability—
ProductElastic Enterprise Search
PublishedAug 18, 2020
First seenAug 18, 2020
Weakness typeCWE-266CWE-266
How to fix
Update
- elastic enterprise_search7.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elastic enterprise_search | v < 7.9.0 | 7.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.