CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-7009
https://notcve.org/view.php?id=CVE-2020-7009
31 Mar 2020 — Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges. Elasticsearch versiones desde 6.7.0 en versiones anteriores a la 6.8.8 y versiones 7.0.0 en versiones anteriores a la 7.6.2 contienen un fallo de escalada de privilegios si un atacante es capaz de crear claves de la AP... • https://discuss.elastic.co/t/elastic-stack-6-8-8-and-7-6-2-security-update/225920 • CWE-266: Incorrect Privilege Assignment CWE-269: Improper Privilege Management •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-7619
https://notcve.org/view.php?id=CVE-2019-7619
30 Oct 2019 — Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm. Elasticsearch versiones 7.0.0 hasta 7.3.2 y versiones 6.7.0 hasta 6.8.3, contienen un fallo de divulgación de nombre de usuario que se encontró en el servicio Key de la API. Un atacante no autenticado podría enviar una petición especialmente diseñada y de... • https://discuss.elastic.co/t/elastic-stack-6-8-4-security-update/204908 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2019-7614
https://notcve.org/view.php?id=CVE-2019-7614
30 Jul 2019 — A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user. Se detectó un fallo de condición de carrera en los encabezados de respuesta que devuelve una petición de Elasticsearch versiones anteriores a 7.2.1 y 6.8.2. Sobre un sistema con múltiples usuarios que envían peticiones,... • https://www.elastic.co/community/security • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •