Security Advisory

CVE-2021-37937

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2023-11-22 01:45:21

Last updated 2024-08-04 01:30:08

Assigner elastic

State PUBLISHED

Description

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.

← Browse all CVEs View on cve.org ↗