PT-2023-12331 · Unknown · Fleet Server

CVE-2021-37937

·

Publicado

2023-11-22

·

Atualizado

2024-03-06

CVSS v3.1

8.8

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Fleet-Server (affected versions not specified)
Description An issue was found with how API keys are created with the Fleet-Server service account, allowing a compromised Fleet-Server service account to potentially escalate themselves to a super-user by creating an API key with higher privileges than intended.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

BIT-ELASTICSEARCH-2021-37937
CVE-2021-37937

Produtos afetados

Fleet Server