CVE-2021-37937 — Improper Privilege Management in Elasticsearch

CWE-269 — Improper Privilege Management4 documents4 sources
Severity
8.8HIGHNVD
CNA5.9
EPSS
0.2%
top 52.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Elasticsearch
Timeline
PublishedNov 22

Description

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5elastic/elasticsearch7.13.0 — 7.14.0
▶NVDelastic/elasticsearch7.13.0 — 7.14.0

🔴Vulnerability Details

3
GHSA
GHSA-4qh7-cr89-jx92: An issue was found with how API keys are created with the Fleet-Server service account↗2023-11-22
▶
CVEList
Elasticsearch privilege escalation↗2023-11-22
▶
OSV
CVE-2021-37937: An issue was found with how API keys are created with the Fleet-Server service account↗2023-11-22
▶
CVE-2021-37937 — Improper Privilege Management | cvebase