Exposure of sensitive information in Elasticsearch

2021-09-2020:29:40

Google

osv.dev

0.001 Low

EPSS

Percentile

44.6%

JSON

A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.

CPENameOperatorVersion
org.elasticsearch:elasticsearcheq7.12.0
org.elasticsearch:elasticsearcheq7.13.1
org.elasticsearch:elasticsearcheq7.11.2
org.elasticsearch:elasticsearcheq7.13.0
org.elasticsearch:elasticsearcheq7.11.1
org.elasticsearch:elasticsearcheq7.13.2
org.elasticsearch:elasticsearcheq7.13.3
org.elasticsearch:elasticsearcheq7.13.4
org.elasticsearch:elasticsearcheq7.11.0
org.elasticsearch:elasticsearcheq7.12.1

Name	Operator	Version
org.elasticsearch:elasticsearch	eq	7.12.0
org.elasticsearch:elasticsearch	eq	7.13.1
org.elasticsearch:elasticsearch	eq	7.11.2
org.elasticsearch:elasticsearch	eq	7.13.0
org.elasticsearch:elasticsearch	eq	7.11.1
org.elasticsearch:elasticsearch	eq	7.13.2
org.elasticsearch:elasticsearch	eq	7.13.3
org.elasticsearch:elasticsearch	eq	7.13.4
org.elasticsearch:elasticsearch	eq	7.11.0
org.elasticsearch:elasticsearch	eq	7.12.1