The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication token can perform a series of steps that result in an authentication token being generated with elevated privileges.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0     to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also     authentication tokens. An attacker who is able to generate an API key and an authentication token can     perform a series of steps that result in an authentication token being generated with elevated privileges.
    (CVE-2020-7014)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0
    to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also
    authentication tokens. An attacker who is able to generate an API key and an authentication token can
    perform a series of steps that result in an authentication token being generated with elevated privileges.
    (CVE-2020-7014)

An update of the elasticsearch package has been released.

ID	Name	Product	Family	Severity
260652	Linux Distros Unpatched Vulnerability : CVE-2020-7014	Nessus	Misc.	high
415900	SCA: security update for org.elasticsearch:elasticsearch (GHSA-hqqv-9x3v-mp7w)	Tenable Cloud Security	SCA Checks	high
415900	SCA: security update for org.elasticsearch:elasticsearch (GHSA-hqqv-9x3v-mp7w)	Tenable Self-Hosted Container Security	SCA Checks	high
203712	Photon OS 3.0: Elasticsearch PHSA-2020-3.0-0103	Nessus	PhotonOS Local Security Checks	high
137637	Photon OS 1.0: Elasticsearch PHSA-2020-1.0-0301	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2020-7014

high

Tenable Plugins

high

high

high

high

high