GHSA-gfv5-grx2-9jw2

Source

https://github.com/advisories/GHSA-gfv5-grx2-9jw2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-gfv5-grx2-9jw2/GHSA-gfv5-grx2-9jw2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gfv5-grx2-9jw2

Aliases

Published

2022-05-24T17:13:01Z

Modified

2024-02-21T05:33:01.378064Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Improper Privilege Management in Elasticsearch

Details

Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

Database specific

{
    "nvd_published_at": "2020-03-31T19:15:00Z",
    "cwe_ids": [
        "CWE-266",
        "CWE-269"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-23T18:02:18Z"
}

References

Affected packages

Maven / org.elasticsearch:elasticsearch

Package

Name: org.elasticsearch:elasticsearch; View open source insights on deps.dev
Purl: pkg:maven/org.elasticsearch/elasticsearch

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.8.8

Affected versions

6.*

6.7.0

6.7.1

6.7.2

6.8.0

6.8.1

6.8.2

6.8.3

6.8.4

6.8.5

6.8.6

6.8.7

Database specific

{
    "last_known_affected_version_range": "<= 6.8.7"
}

Maven / org.elasticsearch:elasticsearch

Package

Name: org.elasticsearch:elasticsearch; View open source insights on deps.dev
Purl: pkg:maven/org.elasticsearch/elasticsearch

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

7.6.2

Affected versions

7.*

7.0.0

7.0.1

7.1.0

7.1.1

7.2.0

7.2.1

7.3.0

7.3.1

7.3.2

7.4.0

7.4.1

7.4.2

7.5.0

7.5.1

7.5.2

7.6.0

7.6.1

Database specific

{
    "last_known_affected_version_range": "<= 7.6.1"
}