Homepage About Snyk

Privilege Escalation Affecting co.elastic.apm:apm-agent-api Open this link in a new tab package, versions [,1.27.0)

0.0
high

  • Attack Complexity

    High

  • Confidentiality

    High

  • Integrity

    High

  • Availability

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-JAVA-COELASTICAPM-2313690

  • published

    9 Dec 2021

  • disclosed

    9 Dec 2021

  • credit

    Unknown

Report a new vulnerability Found a mistake?

Introduced: 9 Dec 2021

CVE-2021-37941 Open this link in a new tab
CWE-269 Open this link in a new tab

How to fix?

Upgrade co.elastic.apm:apm-agent-api to version 1.27.0 or higher.

Overview

Affected versions of this package are vulnerable to Privilege Escalation. A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of permissions than they possess. This vulnerability affects users that have set up the agent via the attacher cli 3, the attach API 2, as well as users that have enabled the profiling_inferred_spans_enabled option