Elasticsearch Elevation of Privilege Vulnerability

Elasticsearch is a set of Dutch Elasticsearch company built on Lucene open source distributed RESTful search engine . The product is mainly used in cloud computing , and supports data indexing via HTTP using JSON. A lifting vulnerability exists in Elasticsearch versions 6.7.0 through 6.8.7 and...

CVE-2020-7009

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

CVE-2020-7009

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

CVE-2020-7009

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

UBUNTU-CVE-2020-7009

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

Privilege escalation

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

CVE-2020-7009

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

ai.ylyue:yue-library-data-es (>=j8.2.2.0, <=j11.2.2.0), br.com.simpli:simpli-ws (>=1.2.1, <=2.2.0) +348 more potentially affected by CVE-2020-7009 via org.elasticsearch:elasticsearch (>=7.0.0, <=7.6.1)

org.elasticsearch:elasticsearch MAVEN version =7.0.0, =j8.2.2.0, =1.2.1, =1.0.2-release, =0.5.1, =1.0, =7.0.0, =1.0.0.0, =1.0.0.0, =7.0.0, =0.0.1, =0.0.2, =0.0.11, =7.0.0.0, =7.5.1.0 and more Source cves: CVE-2020-7009 Source advisory: MEND:CVE-2020-7009...

CVE-2020-7009

CVE-2020-7009 affects Elasticsearch across 6.7.0–6.8.7 and 7.0.0–7.6.2, with a privilege-escalation flaw in the API key/authentication flow that can elevate privileges when an attacker can generate API keys. Public docs reference this vulnerability as a flaw in the API Key service, enabling an at...

CVE-2020-7009

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

CVE-2020-7009

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

Elastic Stack 6.8.8 and 7.6.2 security update

Elasticsearch API key privilege escalation ESA-2020-02 Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API ke...

PT-2020-19334 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions 6.7.0 through 6.8.7 Elasticsearch versions 7.0.0 through 7.6.1 Description: The issue is related to a privilege escalation flaw in Elasticsearch. If an attacker can create API keys, they can perform a series of steps to...

CVE-2020-7009: Incorrect Privilege Assignment

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

cateye (0.3.8), protean (>=0.0.3, <=0.0.5) +5 more potentially affected by CVE-2020-6817 via bleach (2.1.3)

bleach PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - cateye 0.3.8 - protean =0.0.3, =0.4.2, =0.0.1, =0.1.0, =0.2.4 Source cves: CVE-2020-6817 Source advisory: OSV:GHSA-VQHP-CXGC-6WMM...

cateye (0.3.8), protean (>=0.0.3, <=0.0.5) +5 more potentially affected by CVE-2020-6817 via bleach (2.1.3)

bleach PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - cateye 0.3.8 - protean =0.0.3, =0.4.2, =0.0.1, =0.1.0, =0.2.4 Source cves: CVE-2020-6817 Source advisory: OSV:PYSEC-2020-340...

Secure ElasticSearch, Kafka & Other Microservices with Qualys Cloud Platform

In this era of Digital Transformation, microservices are rapidly gaining popularity within continuously deployed systems. Organizations have moved away from the rigid monolithic architectures to more flexible ones that are based on microservices. Lots of organizations handling large amounts of...

cateye (0.3.8), protean (>=0.0.3, <=0.0.5) +5 more potentially affected by CVE-2020-6816 via bleach (2.1.3)

bleach PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - cateye 0.3.8 - protean =0.0.3, =0.4.2, =0.0.1, =0.1.0, =0.2.4 Source cves: CVE-2020-6816 Source advisory: OSV:PYSEC-2020-28...

cateye (0.3.8), protean (>=0.0.3, <=0.0.5) +5 more potentially affected by CVE-2020-6802 via bleach (2.1.3)

bleach PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - cateye 0.3.8 - protean =0.0.3, =0.4.2, =0.0.1, =0.1.0, =0.2.4 Source cves: CVE-2020-6802 Source advisory: OSV:PYSEC-2020-27...

cateye (0.3.8), protean (>=0.0.3, <=0.0.5) +5 more potentially affected by CVE-2020-6816 via bleach (2.1.3)

bleach PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - cateye 0.3.8 - protean =0.0.3, =0.4.2, =0.0.1, =0.1.0, =0.2.4 Source cves: CVE-2020-6816 Source advisory: OSV:GHSA-M6XF-FQ7Q-8743...