CVE-2020-7018

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the ï¿½developerï¿½ role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same permissions of the App Search administrator.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266 CWE-269

Affected software

Vendor	Product	Versions
Elastic	Elastic Enterprise Search	before 7.9.0

References

https://discuss.elastic.co/t/enterprise-search-7-9-0-security-update/245457Vendor Advisory
https://discuss.elastic.co/t/enterprise-search-7-9-0-security-update/245457Vendor Advisory

Timeline

Published: Aug 18, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-70196.5In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a u CVE-2020-70203.1Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search quer CVE-2020-70214.9Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is CVE-2020-70298.8A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communicatio CVE-2020-70305.5A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a loc CVE-2020-70326.5An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct serv CVE-2020-70335.4A Cross Site Scripting (XSS) Vulnerability on the Unified Portal Client (web client) used in Avaya Equinox Conferencing can allow an authent CVE-2020-70348.8A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send sp CVE-2020-70356.5An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticate CVE-2020-70366.5An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to informat CVE-2020-70378.1An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote at CVE-2020-70387.5A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote