PT-2021-4651 · Elastic · Enterprise Search App Search

Published 2021-08-03 · Updated 2022-10-25 · CVE-2021-22149

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Elastic Enterprise Search App Search versions prior to 7.14.0

Description The issue is related to missing authorization for API keys via an alternate route. An authenticated attacker could exploit this to utilize API keys belonging to higher privileged users, potentially leading to privilege escalation. The vulnerability is associated with incorrect permission assignment for API keys.

Recommendations For Elastic Enterprise Search App Search versions prior to 7.14.0, update to version 7.14.0 or later to resolve the issue. As a temporary workaround, consider restricting access to API keys and limiting the privileges associated with them until a patch is applied. Avoid using API keys that belong to higher privileged users in the affected versions.

Fix

Incorrect Permission

Missing Authorization

Weakness Enumeration

CWE-732

CWE-862

Related Identifiers

BDU:2021-05344

CVE-2021-22149

Affected Products

Enterprise Search App Search

References · 6

• https://elastic.co/community/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22149 · Security Note
• https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22149 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05344 · Security Note
• https://t.me/cvenotify/21456 · Telegram Post