CVE-2021-22149 | BDVDB-2026-160940 Detail

ElasticElastic Enterprise Search

Description#

Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-732 Incorrect Permission Assignment for Critical Resource

References#

https://www.elastic.co/community/security/
https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344

Exploit#

No public exploit known

History#

Version 12021-09-15Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.