{"containers": {"cna": {"affected": [{"product": "Elastic Enterprise Search", "vendor": "Elastic", "versions": [{"status": "affected", "version": "before 7.9.0"}]}], "descriptions": [{"lang": "en", "value": "Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the \u00ef\u00bf\u00bddeveloper\u00ef\u00bf\u00bd role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same permissions of the App Search administrator."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-266", "description": "CWE-266: Incorrect Privilege Assignment", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-08-18T16:40:14", "orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "shortName": "elastic"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://discuss.elastic.co/t/enterprise-search-7-9-0-security-update/245457"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@elastic.co", "ID": "CVE-2020-7018", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Elastic Enterprise Search", "version": {"version_data": [{"version_value": "before 7.9.0"}]}}]}, "vendor_name": "Elastic"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the \u00ef\u00bf\u00bddeveloper\u00ef\u00bf\u00bd role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same permissions of the App Search administrator."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-266: Incorrect Privilege Assignment"}]}]}, "references": {"reference_data": [{"name": "https://discuss.elastic.co/t/enterprise-search-7-9-0-security-update/245457", "refsource": "MISC", "url": "https://discuss.elastic.co/t/enterprise-search-7-9-0-security-update/245457"}]}}}}, "cveMetadata": {"assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "assignerShortName": "elastic", "cveId": "CVE-2020-7018", "datePublished": "2020-08-18T16:40:14", "dateReserved": "2020-01-14T00:00:00", "dateUpdated": "2020-08-18T16:40:14", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elastic:enterprise_search:*:*:*:*:*:*:*:*", "matchCriteriaId": "367A998E-1763-4AAE-A971-9FFA0D9A4030", "versionEndExcluding": "7.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the \u00ef\u00bf\u00bddeveloper\u00ef\u00bf\u00bd role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same permissions of the App Search administrator."}, {"lang": "es", "value": "Elastic Enterprise Search versiones anteriores a 7.9.0, contiene un fallo de exposici\u00f3n de credenciales en la Interfaz App Search. Si a un usuario se le asigna el rol \u00ef\u00bf\u00bddeveloper\u00ef\u00bf\u00bd, podr\u00e1 visualizar las credenciales de la API de administrador. Estas credenciales podr\u00edan permitir al usuario desarrollador conducir operaciones con los mismos permisos del administrador de App Search."}], "id": "CVE-2020-7018", "lastModified": "2020-08-26T14:11:08.190", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-08-18T17:15:11.627", "references": [{"source": "bressers@elastic.co", "tags": ["Vendor Advisory"], "url": "https://discuss.elastic.co/t/enterprise-search-7-9-0-security-update/245457"}], "sourceIdentifier": "bressers@elastic.co", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-266"}], "source": "bressers@elastic.co", "type": "Secondary"}]}

{}