CVE-2020-7011
CVE-2020-7011
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
03 Jun 2020Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be rendered by the web browser. If an attacker is able to control the contents of such a field, they could execute arbitrary JavaScript in the victim�s web browser.
Affected products
Elastic · Elastic App SearchWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →