Authorization

2021-09-1512:15:00

PRIOn knowledge base

www.prio-n.com

8.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.8%

JSON

Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users.

CPENameOperatorVersion
enterprise_searchlt7.14.0

CPE	Name	Operator	Version
	enterprise_search	lt	7.14.0

References

discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344

www.elastic.co/community/security/