CVE-2021-22137CWE-200

CVE-2021-22137: fallo en Elasticsearch

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Elasticsearch+ Monitorear org.elasticsearch:elasticsearch

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 1.2%
In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.
Productos afectados
Elastic · Elasticsearch
CVEs relacionadas — Elasticsearch

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-22145—CVE-2021-22145EPSS 76.2%CVE-2023-31419MEDIUMElasticsearch StackOverflow vulnerabilityEPSS 61.1%CVE-2019-7619—CVE-2019-7619EPSS 2.4%CVE-2019-7611—CVE-2019-7611EPSS 2.1%CVE-2023-31418HIGHElasticsearch uncontrolled resource consumptionEPSS 2.1%CVE-2018-3831—CVE-2018-3831EPSS 2.0%