Elastic Cloud Enterprise vulnerabilities
7 known vulnerabilities in Elastic Cloud Enterprise from Elastic. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Elastic Cloud Enterprise: Improper Link Resolution Before File Access
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132).
- 8.2 High severity
Elastic Cloud Enterprise: Improper Link Resolution Before File Access
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).
- 7.2 High severity
Elastic Cloud Enterprise: Improper Link Resolution Before File Access
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132).
- 8.8 High severity
Elastic Cloud Enterprise (ECE): Incorrect Authorization
Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The list of APIs that are affected by this issue is: post:/platform/configuration/security/service-ac
- 7.2 High severity
Elastic Cloud Enterprise (ECE): Improper Neutralization of Special Elements Used in a Template Engine
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variabl
- 9.8 Critical severity
Elastic Cloud Enterprise: Improper Authorization
It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys that have elevated privileges.
- 7.5 High severity
Elasticsearch: Uncontrolled Resource Consumption
An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was