原始描述
The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication token can perform a series of steps that result in an authentication token being generated with elevated privileges.
受影响的软件
- Elasticsearch ≥ 6.7.0 ≤ 6.8.7= 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1≥ 7.0.0 ≤ 7.6.1 精确匹配
详情
- 发布日期
- 2020-06-04
- 最后修改
- 2024-08-04
- CVSS 向量
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- CWE
- CWE-266
参考资料
本产品使用 NVD API 的数据，但未获得 NVD 的认可或认证。CVE® 是 The MITRE Corporation 的注册商标；CVE 记录依据 CVE Program 使用条款使用。