AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ElasticsearchGHSA-45h5-r968-5xr7

Exposure of sensitive information in Elasticsearch

Elasticsearch

CVE-2021-22147 · Published Sep 20, 2021 · updated Feb 17, 2024

Medium6.5
Fix: upgrade to 7.14.0 or later
GitHub advisory

A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.

Affected versions

PackageAffectedFixed in
org.elasticsearch:elasticsearch
Maven
>= 7.11.0, < 7.14.07.14.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-732, CWE-862
Also known as
BIT-elasticsearch-2021-22147, CVE-2021-22147

More Elasticsearch advisories

All Elasticsearch
Medium 4.3Mar 4, 2022Elasticsearch privilege escalationCVE-2022-23708fixed in 7.17.1Medium 5.7Aug 9, 2021Denial of Service in ElasticsearchCVE-2021-22144fixed in 6.8.17 +1Medium 5.3Jul 2, 2021API information disclosure flaw in ElasticsearchCVE-2021-22135fixed in 6.8.15 +1Medium 4.8Mar 18, 2021Insufficiently Protected Credentials in ElasticsearchCVE-2021-22132fixed in 7.10.2Medium 8.8Mar 18, 2021Privilege Escalation Flaw in ElasticsearchCVE-2020-7014fixed in 6.8.8 +1Low 3.1Mar 18, 2021Privilege Context Switching Error in ElasticsearchCVE-2020-7020fixed in 6.8.13 +1