Lucene search

ElasticCVELIST:CVE-2020-7018

HistoryAug 18, 2020 - 4:40 p.m.

CVE-2020-7018

2020-08-1816:40:14

CWE-266

elastic

www.cve.org

elastic

enterprise search

credential exposure

app search

administrator api

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the ï¿½developerï¿½ role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same permissions of the App Search administrator.

CNA Affected

[
  {
    "product": "Elastic Enterprise Search",
    "vendor": "Elastic",
    "versions": [
      {
        "status": "affected",
        "version": "before 7.9.0"
      }
    ]
  }
]

References

discuss.elastic.co/t/enterprise-search-7-9-0-security-update/245457