CVE-2021-22149 Vulnerability Details

  /     /     /  

CVE-2021-22149 Metadata Quick Info

CVE Published: 15/09/2021 | CVE Updated: 03/08/2024 | CVE Year: 2021
Source: elastic | Vendor: Elastic | Product: Elastic Enterprise Search
Status : PUBLISHED

---

CVE-2021-22149 Description

Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-732
CWE Name: CWE-732: Incorrect Permission Assignment for Critical Resource
Source: Elastic

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).