CVE-2020-7009CWE-266

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys

published March 31, 2020

CVSS
—
EPSS
2%
Percentile
79.3
In the wild
Unconfirmed
What it is

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01881 · 79.3th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2020-03-31T19:05Z
EPSS history
Timeline
  • 31 MAR 19:05Z
    Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys
    cvelistv5