CVE-2020-7010
Quick assessment
Affected
Elastic Elastic Cloud on Kubernetes
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Elasticsearch Elastic Cloud on Kubernetes是荷兰Elasticsearch公司的基于操作员模式自动部署、配置、管理和编排Elasticsearch、Kibana、APM 服务器、企业搜索和 Beats on Kubernetes。 Elasticsearch Elastic Cloud on Kubernetes 1.1.0之前版本存在安全漏洞，该漏洞源于程序使用弱随机数生成器生成密码。攻击者可利用该漏洞暴力破解ECK生成的Elasticsearch凭证。
Possible ATT&CK Techniques 1 AI
T1110 · Brute Force
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-7010
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
PRNG种子错误
Source: CVE Program / CVE List V5
Vulnerability Title
Elastic Cloud on Kubernetes 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Elasticsearch Elastic Cloud on Kubernetes是荷兰Elasticsearch公司的基于操作员模式自动部署、配置、管理和编排Elasticsearch、Kibana、APM 服务器、企业搜索和 Beats on Kubernetes。 Elasticsearch Elastic Cloud on Kubernetes 1.1.0之前版本存在安全漏洞，该漏洞源于程序使用弱随机数生成器生成密码。攻击者可利用该漏洞暴力破解ECK生成的Elasticsearch凭证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Elastic | Elastic Cloud on Kubernetes | before 1.1.0 | - |
|
II. Public POCs for CVE-2020-7010
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-7010
请登录查看更多情报信息。
Other References for CVE-2020-7010 (1)
-
https://www.elastic.co/community/security/ x_refsource_MISC
Same Patch Batch · Elastic · 2020-06-03 · 6 CVEs total
| CVE-2020-7011 | Elastic App Search 跨站脚本漏洞 | |
| CVE-2020-7012 | Elasticsearch Kibana 代码注入漏洞 | |
| CVE-2020-7013 | Elasticsearch Kibana 代码注入漏洞 | |
| CVE-2020-7014 | Elasticsearch 安全漏洞 | |
| CVE-2020-7015 | Elasticsearch Kibana 跨站脚本漏洞 |
IV. Related Vulnerabilities
Same vendor: Elastic
-
CVE-2026-103009
Authorization Bypass Through User-Controlled Key in Elastics -
CVE-2026-103008
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-103007
Incorrect Authorization in Elasticsearch Leading to Privileg -
CVE-2026-103006
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-103005
Memory Allocation with Excessive Size Value in Elasticsearch
Same weakness: CWE-335
-
CVE-2026-11702
Bytes::Random::Secure::Tiny versions through 1.011 for Perl -
CVE-2026-11625
Bytes::Random::Secure versions through 0.29 for Perl share i -
CVE-2026-41564
CryptX versions before 0.088 for Perl do not reseed the Cryp -
CVE-2026-3503
Fault injection attack with ML-DSA and ML-KEM on ARM -
CVE-2025-52578
Gallagher HBUS Devices 安全漏洞
V. Comments for CVE-2020-7010
No comments yet