← Volver a CVEs

CVE-2021-22135

MEDIUM

5.3

Descripcion

Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.

Detalles CVE

Puntuacion CVSS v3.15.3

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado5/13/2021

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

elastic:elasticsearch

Debilidades (CWE)

CWE-200CWE-200

Referencias

https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125(security@elastic.co)

https://security.netapp.com/advisory/ntap-20210625-0003/(security@elastic.co)

https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20210625-0003/(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.