{"id":"CVE-2021-37942","aliases":["EUVD-2023-2892","GHSA-5xqm-hc45-f2g2"],"status":"published","title":"APM Java Agent Local Privilege Escalation","description":"A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00249,"percentile":0.16369,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2023-11-22T01:33:48Z","modified":"2026-10-24T10:30:57Z","fixes":[{"ecosystem":"Maven","package":"co.elastic.apm:apm-agent-parent","fixed_in":["1.27.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"co.elastic.apm:elastic-apm-agent","fixed_in":["1.27.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"co.elastic.apm:apm-agent-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.27.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"co.elastic.apm:elastic-apm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.27.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"co.elastic.apm:apm-agent-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.27.1"}]}],"versions":["1.18.0","1.18.1","1.19.0","1.20.0","1.21.0","1.22.0","1.23.0","1.24.0","1.25.0","1.26.0","1.26.1","1.26.2","1.27.0"]},{"source":"osv","ecosystem":"Maven","package":"co.elastic.apm:elastic-apm-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.27.1"}]}],"versions":["1.18.0","1.18.1","1.19.0","1.20.0","1.21.0","1.22.0","1.23.0","1.24.0","1.25.0","1.26.0","1.26.1","1.26.2","1.27.0"]}],"products":[{"vendor":"elastic","product":"apm_java_agent"},{"vendor":"elastic","product":"elastic apm java agent"}],"references":[{"url":"https://discuss.elastic.co/t/apm-java-agent-security-update/291355","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://www.elastic.co/community/security","tags":["x_transferred","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37942","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5xqm-hc45-f2g2"},{"url":"https://github.com/elastic/apm-agent-java","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-37942","title":"APM Java Agent Local Privilege Escalation","description":"A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.","status":"published","published":"2023-11-22T01:33:48.984Z","modified":"2024-08-04T01:30:09.172Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:32:58.359368Z"}],"euvd":[{"id":"EUVD-2023-2892","description":"A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.","status":"published","published":"2023-11-22T01:33:48Z","modified":"2024-08-04T01:30:09Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:24:25.678078Z"}],"ghsa":[{"id":"GHSA-5xqm-hc45-f2g2","title":"APM Java Agent Local Privilege Escalation issue","description":"A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.","status":"published","published":"2023-11-22T03:30:19Z","modified":"2025-09-30T16:35:25Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:38:59.83883Z"}],"nvd":[{"id":"CVE-2021-37942","description":"A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.","status":"published","published":"2023-11-22T02:15:42.22Z","modified":"2026-06-17T04:01:17.713Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:07:07.764332Z"}],"osv":[{"id":"CVE-2021-37942","description":"A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.","status":"published","published":"2023-11-22T02:15:42.22Z","modified":"2026-10-24T10:30:57.641128113Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"GHSA-5xqm-hc45-f2g2","title":"APM Java Agent Local Privilege Escalation issue","description":"A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.","status":"published","published":"2023-11-22T03:30:19Z","modified":"2025-09-30T17:23:17.050609Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}