CVE-2021-37937

Elasticsearch privilege escalation

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami elasticsearch

[{"type":"SEMVER","events":[{"introduced":"7.13.0"},{"fixed":"7.14.1"}]}]

Références

advisory discuss.elastic.co
advisory elastic.co
web nvd.nist.gov