GHSA-gfv5-grx2-9jw2
Improper Privilege Management in Elasticsearch
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.elasticsearch:elasticsearch | >= 6.7.0, < 6.8.8 | 6.8.8 |
| Maven | org.elasticsearch:elasticsearch | >= 7.0.0, < 7.6.2 | 7.6.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
References
External links from the advisory. They lead to third-party sites.