CVE-2021-22149
First published: Wed Sep 15 2021(Updated: )
Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users.
Credit: bressers@elastic.co
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Elastic Enterprise Search | <7.14.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-22149.
What is the severity of CVE-2021-22149?
The severity of CVE-2021-22149 is high with a severity value of 8.8.
What is the affected software for CVE-2021-22149?
The affected software for CVE-2021-22149 is Elastic Enterprise Search App Search versions before 7.14.0.
What is the description of CVE-2021-22149?
CVE-2021-22149 is a vulnerability in Elastic Enterprise Search App Search versions before 7.14.0 where API keys were missing authorization via an alternate route, allowing an authenticated attacker to utilize API keys belonging to higher privileged users.
How can I fix CVE-2021-22149?
To fix CVE-2021-22149, you should upgrade to Elastic Enterprise Search App Search version 7.14.0 or newer.
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- agent/description
- agent/type
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/elastic
- canonical/elastic enterprise search