Lucene search
ElasticCVELIST:CVE-2024-37282HistoryJun 28, 2024 - 4:58 a.m.
CVE-2024-37282
2024-06-2804:58:18
CWE-285
elastic
www.cve.org
6
api key
vulnerability
privilege escalation
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
0.0004 Low
EPSS
Percentile
9.1%
It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys that have elevated privileges.
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "Elastic Cloud Enterprise",
"vendor": "Elastic",
"versions": [
{
"lessThan": "3.7.2",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
]
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
0.0004 Low
EPSS
Percentile
9.1%
Related for CVELIST:CVE-2024-37282