CVE-2020-7014 — Incorrect Privilege Assignment in Elasticsearch

CWE-266 — Incorrect Privilege AssignmentCWE-269 — Improper Privilege Management8 documents7 sources
Severity
8.8HIGHNVD
EPSS
0.5%
top 35.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Elasticsearch
Timeline
PublishedJun 3
Latest updateMar 18

Description

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication token can perform a series of steps that result in an authentication token being generated with elevated privileges.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDelastic/elasticsearch6.7.0 — 6.8.7+1
▶CVEListV5elastic/elasticsearch6.7.0 to 6.8.7 and 7.0.0 to 7.6.1

🔴Vulnerability Details

4
OSV
Privilege Escalation Flaw in Elasticsearch↗2021-03-18
▶
GHSA
Privilege Escalation Flaw in Elasticsearch↗2021-03-18
▶
CVEList
CVE-2020-7014: The fix for CVE-2020-7009 was found to be incomplete↗2020-06-03
▶
OSV
CVE-2020-7014: The fix for CVE-2020-7009 was found to be incomplete↗2020-06-03
▶

📋Vendor Advisories

2
Microsoft
The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and al↗2020-06-09
▶
Red Hat
elasticsearch: Incomplete fix for CVE-2020-7009 could result in generating API key with elevated privileges↗2020-06-03
▶

💬Community

1
Bugzilla
CVE-2020-7014 elasticsearch: Incomplete fix for CVE-2020-7009 could result in generating API key with elevated privileges↗2020-06-19
▶
CVE-2020-7014 — Incorrect Privilege Assignment | cvebase