CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2021-37942
High (7.8) in elastic apm java agent. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in co.elastic.apm:apm-agent-parent 1.27.1.
A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-11-01)
- CWE
- CWE-269
- Published
- Modified
- Record from
- the NVD, synced
Affected
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5xqm-hc45-f2g2 | Maven | co.elastic.apm:apm-agent-parent | >=1.18.0 <1.27.1 | 1.27.1 |
| GHSA-5xqm-hc45-f2g2 | Maven | co.elastic.apm:elastic-apm-agent | >=1.18.0 <1.27.1 | 1.27.1 |