CVE-2021-22132
published 2021-01-14CVE-2021-22132: Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store…
PriorityP424medium4.8CVSS 3.1
AVNACHPRLUIRSUCHINAN
EPSS
1.24%
65.5th percentile
Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | — | — |
| elastic | elasticsearch | >= 7.7.0 < 7.10.2 | 7.10.2 |
| oracle | communications_cloud_native_core_automated_test_suite | — | — |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:N/AC:H/Au:S/C:P/I:N/A:N
osv4.8MEDIUM
vendor_oracle4.8MEDIUM
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Communications Risk Matrix: Automated Test Suite Framework (Elasticsearch) — CVE-2021-22132
vendor_oracle·2022-04-15·CVSS 4.8
CVE-2021-22132 [MEDIUM] Oracle Oracle Communications Risk Matrix: Automated Test Suite Framework (Elasticsearch) — CVE-2021-22132
Oracle Oracle Communications Risk Matrix: Automated Test Suite Framework (Elasticsearch) vulnerability
CVE: CVE-2021-22132
CVSS: 4.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Red Hat
elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure
vendor_redhat·2021-01-14·CVSS 4.8
CVE-2021-22132 [MEDIUM] CWE-522 elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure
elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure
Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2
Package: elasticsearch (Red Hat Decision Manager 7) - Will not fix
Package: elasticsearch (Red Hat Fuse 7) - Fix deferred
Package: elasticsearch (Red Hat Integration Camel Quarkus 1) - Not affected
Package: elasticsearch (Red Hat JBoss Fuse 6) - Out of support scope
Package: openshift3/ose-logging-elasticsearch5 (Red Hat OpenShift Con
GHSA
Insufficiently Protected Credentials in Elasticsearch
ghsa·2021-03-18
CVE-2021-22132 [MEDIUM] CWE-522 Insufficiently Protected Credentials in Elasticsearch
Insufficiently Protected Credentials in Elasticsearch
Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2
OSV
Insufficiently Protected Credentials in Elasticsearch
osv·2021-03-18
CVE-2021-22132 [MEDIUM] Insufficiently Protected Credentials in Elasticsearch
Insufficiently Protected Credentials in Elasticsearch
Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2
OSV
CVE-2021-22132: Elasticsearch versions 7
osv·2021-01-14·CVSS 4.8
CVE-2021-22132 [MEDIUM] CVE-2021-22132: Elasticsearch versions 7
Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2
No detection rules found.
No public exploits indexed.
https://discuss.elastic.co/t/elasticsearch-7-10-2-security-update/261164https://security.netapp.com/advisory/ntap-20210219-0004/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://discuss.elastic.co/t/elasticsearch-7-10-2-security-update/261164https://security.netapp.com/advisory/ntap-20210219-0004/https://www.oracle.com/security-alerts/cpuapr2022.html
2021-01-14
Published