1. Home
  2. Vulnerabilities
  3. CVE-2021-22135

CVE-2021-22135

CVSS v3.1 5.3 (Medium)
53% Progress
CVSS v2.0 4.3 (Medium)
43% Progress
EPSS 0.09 % (39th)
0.09% Progress
Affected Products 1
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.

Weaknesses
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE Status
PUBLISHED
CNA
Elastic
Published Date
2021-05-13 18:15:08
(3 years ago)
Updated Date
2021-09-07 22:06:49
(3 years ago)

Affected Products

Elastic

Configuration #1

    CPE23 From Up To
  Elasticsearch prior 6.8.15 version cpe:2.3:a:elastic:elasticsearch < 6.8.15
  Elasticsearch from 7.11.0 version and prior 7.11.2 version cpe:2.3:a:elastic:elasticsearch >= 7.11.0 < 7.11.2