What’s Vulnerable › Vulnerabilities

CVE-2020-7018

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-08-18 · updated 2026-06-17
• Weakness: CWE-266

Description

Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the �developer� role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same permissions of the App Search administrator.

Affected products

• Elastic Enterprise Search: before 7.9.0 — fixed in 7.9.0

How to fix

Upgrade to a fixed version: Elastic Enterprise Search 7.9.0. Check the vendor advisory for mitigations.

References

• https://discuss.elastic.co/t/enterprise-search-7-9-0-security-update/245457
• https://discuss.elastic.co/t/enterprise-search-7-9-0-security-update/245457

Get alerted when CVE-2020-7018 or the next vulnerability affects your stack