CVE-2021-37942: APM Java Agent Local Privilege Escalation issue

November 22, 2023 (updated September 30, 2025)

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user typically has access to.

References

discuss.elastic.co/t/apm-java-agent-security-update/291355
github.com/advisories/GHSA-5xqm-hc45-f2g2
github.com/elastic/apm-agent-java
nvd.nist.gov/vuln/detail/CVE-2021-37942
www.elastic.co/community/security

Code Behaviors & Features

Detect and mitigate CVE-2021-37942 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →