CVE-2021-22149
HIGHElastic Enterprise Search < 7.14.0 - Missing Authorization
Title source: ruleDescription
Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://www.elastic.co/community/security/
Vendor Advisory x_refsource_misc
https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344
Scores
CVSS v3
8.8
EPSS
0.0027
EPSS Percentile
50.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-862
CWE-732
Status
published
Products (1)
elastic/enterprise_search
< 7.14.0
Published
Sep 15, 2021
Tracked Since
Feb 18, 2026