CVE-2021-37941: 
Python vulnerability analysis and mitigation

A local privilege escalation vulnerability (CVE-2021-37941) was discovered in the Elastic APM Java agent, affecting versions 1.10.0 through 1.26.0. The vulnerability was disclosed on November 18, 2021, and allows a local user to escalate privileges by attaching a malicious file to an application running with the APM Java agent (Vendor Advisory).

The vulnerability occurs when users set up the agent via the attacher CLI, the attach API, or have enabled the profilinginferredspans_enabled option. The vulnerability has a CVSS v3.1 Base Score of 7.8 HIGH (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-269 (Improper Privilege Management) (NVD).

When exploited, this vulnerability allows a malicious or compromised user account to execute commands with elevated privileges beyond their assigned permissions. This could lead to unauthorized access to system resources and potential system compromise (Vendor Advisory).

Users are advised to update to version 1.27.0 or newer. Alternatively, users can employ the unaffected -javaagent-based installation method and disable the profilinginferredspans_enabled option (Vendor Advisory).