CVE-2021-22149: High severity elastic enterprise search vulnerability
Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-22149.
What is the severity of CVE-2021-22149?
The severity of CVE-2021-22149 is high with a severity value of 8.8.
What is the affected software for CVE-2021-22149?
The affected software for CVE-2021-22149 is Elastic Enterprise Search App Search versions before 7.14.0.
What is the description of CVE-2021-22149?
CVE-2021-22149 is a vulnerability in Elastic Enterprise Search App Search versions before 7.14.0 where API keys were missing authorization via an alternate route, allowing an authenticated attacker to utilize API keys belonging to higher privileged users.
How can I fix CVE-2021-22149?
To fix CVE-2021-22149, you should upgrade to Elastic Enterprise Search App Search version 7.14.0 or newer.