Skip to main content

Enterprise Search CVE-2021-22149

HIGH
Incorrect Permission Assignment for Critical Resource (CWE-732)
2021-09-15 security@elastic.co
Elastic Information Disclosure Enterprise Search
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Sep 15, 2021 - 12:15 nvd
HIGH 8.8

DescriptionNVD

Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users.

AnalysisAI

Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Permission Assignment (CWE-732), which allows attackers to access resources due to misconfigured permissions. Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alternate route. Using this vulnerability, an authenticated attacker could utilize API keys belonging to higher privileged users. Affected products include: Elastic Enterprise Search. Version information: before 7.14.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and restrict file/resource permissions, apply principle of least privilege.

More in Enterprise Search

View all
CVE-2021-22148 HIGH
8.8 Sep 15

Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to

CVE-2020-7018 HIGH
8.8 Aug 18

Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. Rated high severi
CVE-2021-37940 MEDIUM
6.8 Dec 07

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Se
CVE-2023-49923 MEDIUM
6.5 Dec 12

An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all
CVE-2017-9462 HIGH POC
8.8
CVE-2017-3006 HIGH POC
8.8
CVE-2017-9602 CRITICAL POC
9.8
CVE-2022-22960 HIGH POC
7.8
CVE-2021-38085 HIGH POC
7.8
CVE-2021-35449 HIGH POC
7.8
CVE-2020-11855 HIGH POC
7.8
CVE-2020-10883 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2021-22149 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy