CVE-2021-37937

MEDIUM

Elasticsearch 7.13.0-7.13.9 - Privilege Escalation via Fleet-Server API Key Creation

Title source: llm
STIX 2.1

Description

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.

References (2)

Core 2

Scores

CVSS v3 5.9
EPSS 0.0024
EPSS Percentile 47.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-269
Status published
Products (1)
elastic/elasticsearch 7.13.0 - 7.14.0
Published Nov 22, 2023
Tracked Since Feb 18, 2026