1. Home
  2. CVE Database
  3. CVE-2020-7010
HIGH · 7.5

CVE-2020-7010

Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deploy...

Vulnerability Description

Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
ElasticElastic Cloud On Kubernetes< 1.1.0

Related Weaknesses (CWE)

CWE-335

References

FAQ

What is CVE-2020-7010?

CVE-2020-7010 is a vulnerability with a CVSS score of 7.5 (HIGH). Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deploy...

How severe is CVE-2020-7010?

CVE-2020-7010 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-7010?

Check the references section above for vendor advisories and patch information. Affected products include: Elastic Elastic Cloud On Kubernetes.