# Elastic Cloud Enterprise 3.7.2 Security Update (ESA-2024-18)

**URL:** https://discuss.elastic.co/t/elastic-cloud-enterprise-3-7-2-security-update-esa-2024-18/362181
**Category:** Security Announcements
**Created:** [June 28, 2024, 4:54am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-3-7-2-security-update-esa-2024-18/362181 "2024-06-28T04:54:13Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [June 28, 2024, 4:54am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-3-7-2-security-update-esa-2024-18/362181/1 "2024-06-28T04:54:13Z")

</div>

### ECE Improper Authorization (ESA-2024-18)

It was identified that under certain specific preconditions, an [API key](https://www.elastic.co/guide/en/cloud-enterprise/current/ece-restful-api-authentication.html#ece-api-keys) that was originally created with a specific privileges could be subsequently used to create new API keys that have elevated privileges.

### Affected Versions:

ECE versions after 3.0.0 and before 3.7.2

### Solutions and Mitigations:

Users should upgrade to version 3.7.2.

**Severity:** CVSSv3: 8.1(High) - [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

**CVE ID:** CVE-2024-37282