Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2020-7010 Details

Description

Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://www.elastic.co/community/security/ CVEVendor Advisory
https://www.elastic.co/community/security/ [email protected]Vendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)[email protected]
CWE-335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)[email protected]

Affected Products

ProductVersions
elastic elastic cloud on kubernetes
< 1.1.0

CPE

  • cpe:2.3:a:elastic:elastic_cloud_on_kubernetes:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2020-7010
NVD Published Date:
Jun 3, 2020
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]