Vulnerability Details CVE-2021-22149
Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 70.8%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
References
Products affected by CVE-2021-22149
-
cpe:2.3:a:elastic:enterprise_search:-
-
cpe:2.3:a:elastic:enterprise_search:7.10.0
-
cpe:2.3:a:elastic:enterprise_search:7.10.1
-
cpe:2.3:a:elastic:enterprise_search:7.10.2
-
cpe:2.3:a:elastic:enterprise_search:7.11.0
-
cpe:2.3:a:elastic:enterprise_search:7.11.1
-
cpe:2.3:a:elastic:enterprise_search:7.11.2
-
cpe:2.3:a:elastic:enterprise_search:7.11.3
-
cpe:2.3:a:elastic:enterprise_search:7.12.0
-
cpe:2.3:a:elastic:enterprise_search:7.12.1
-
cpe:2.3:a:elastic:enterprise_search:7.13.0
-
cpe:2.3:a:elastic:enterprise_search:7.13.1
-
cpe:2.3:a:elastic:enterprise_search:7.13.2
-
cpe:2.3:a:elastic:enterprise_search:7.13.3
-
cpe:2.3:a:elastic:enterprise_search:7.13.4
-
cpe:2.3:a:elastic:enterprise_search:7.7.0
-
cpe:2.3:a:elastic:enterprise_search:7.7.1
-
cpe:2.3:a:elastic:enterprise_search:7.8.0
-
cpe:2.3:a:elastic:enterprise_search:7.8.1
-
cpe:2.3:a:elastic:enterprise_search:7.9.0
-
cpe:2.3:a:elastic:enterprise_search:7.9.1
-
cpe:2.3:a:elastic:enterprise_search:7.9.2
-
cpe:2.3:a:elastic:enterprise_search:7.9.3