Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-22149

Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users.

Published

2021-09-15T12:15:09.073

Last Modified

2024-11-21T05:49:36.180

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.0

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-732
  • Type: Primary
    CWE-862
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application elastic enterprise_search < 7.14.0 Yes
References