Skip to main content

Enterprise Search CVE-2020-7018

HIGH
Incorrect Privilege Assignment (CWE-266)
2020-08-18 security@elastic.co
Elastic Information Disclosure Enterprise Search
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Aug 18, 2020 - 17:15 nvd
HIGH 8.8

DescriptionNVD

Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the �developer� role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same permissions of the App Search administrator.

AnalysisAI

Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-266. Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the �developer� role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same permissions of the App Search administrator. Affected products include: Elastic Enterprise Search. Version information: before 7.9.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Enterprise Search

View all
CVE-2021-22149 HIGH
8.8 Sep 15

Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing autho
CVE-2021-22148 HIGH
8.8 Sep 15

Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to

CVE-2021-37940 MEDIUM
6.8 Dec 07

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Se
CVE-2023-49923 MEDIUM
6.5 Dec 12

An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents

Same weakness CWE-266 – Incorrect Privilege Assignment

View all
CVE-2025-27007 CRITICAL POC
9.8
CVE-2024-28000 CRITICAL POC
9.8
CVE-2026-48172 CRITICAL POC
10.0
CVE-2024-24882 CRITICAL POC
9.8
CVE-2025-47539 CRITICAL POC
9.8
CVE-2024-54363 CRITICAL
9.8
CVE-2026-23550 CRITICAL POC
9.8
CVE-2024-50485 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2020-7018 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy