What is CVE-2020-7010?

CVE-2020-7010 is a high-severity vulnerability in Elastic Cloud On Kubernetes, classified under Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG). CVSS score: 7.5/10. Published 2020-06-03.

How severe is CVE-2020-7010?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Elastic Cloud On Kubernetes

CVE-2020-7010

Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.

EPSS: 0.014 (70.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Elastic Cloud On Kubernetes — versions before 1.1.0
Elastic Elastic_cloud_on_kubernetes

Weakness classification (CWE)

CWE-335 — Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

References

security@elastic.co (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-7010?: CVE-2020-7010 is a high-severity vulnerability in Elastic Cloud On Kubernetes, classified under Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG). CVSS score: 7.5/10. Published 2020-06-03.
How severe is CVE-2020-7010?: High severity. CVSS v3 base score is 7.5 out of 10.