Unrated severityNVD Advisory· Published Nov 22, 2023· Updated Aug 4, 2024
Elasticsearch privilege escalation
CVE-2021-37937
Description
An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.
Affected products
2- Range: 7.13.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.