CVE-2020-7014: 
Java vulnerability analysis and mitigation

The vulnerability (CVE-2020-7014) was identified as an incomplete fix for CVE-2020-7009, affecting Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1. The issue was discovered and initially recorded on January 14, 2020, involving a privilege escalation flaw that could be exploited when an attacker has the ability to create both API keys and authentication tokens (MITRE CVE).

The vulnerability allows an attacker who can generate both an API key and an authentication token to perform a series of steps resulting in the creation of an authentication token with elevated privileges. The vulnerability has received a CVSS score of 8.8 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NetApp Advisory).

When successfully exploited, this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS) (NetApp Advisory).

Public discussion of this vulnerability has been confirmed, indicating awareness in the security community. The vulnerability requires an attacker to have the ability to create API keys and authentication tokens, which serves as a prerequisite for exploitation (NetApp Advisory).

The vulnerability affects specific versions of Elasticsearch, and users are advised to upgrade to versions newer than 6.8.7 for the 6.x series or versions newer than 7.6.1 for the 7.x series to address this security issue (MITRE CVE).