Elastic Enterprise Search vulnerabilities
3 vulnerabilities
Known vulnerabilities in Elastic Enterprise Search, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-22148elasticelastic enterprise search+1
EPSS score0.83%
Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as their creator. This could lead to a less privileged user gaining access to unauthorized engines.CVE-2021-22149elasticelastic enterprise search+1EPSS score0.83%
Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users.CVE-2020-7018ubuntuelasticsearch+2EPSS score1.09%
Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the �developer� role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same permissions of the App Search administrator.