CVE-2021-22135
published 2021-05-13CVE-2021-22135: Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
1.16%
63.3th percentile
Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | < 6.8.15 | 6.8.15 |
| elastic | elasticsearch | — | — |
| elastic | elasticsearch | >= 7.11.0 < 7.11.2 | 7.11.2 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
API information disclosure flaw in Elasticsearch
osv·2021-07-02
CVE-2021-22135 [MEDIUM] API information disclosure flaw in Elasticsearch
API information disclosure flaw in Elasticsearch
Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.
GHSA
API information disclosure flaw in Elasticsearch
ghsa·2021-07-02
CVE-2021-22135 [MEDIUM] CWE-200 API information disclosure flaw in Elasticsearch
API information disclosure flaw in Elasticsearch
Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.
OSV
CVE-2021-22135: Elasticsearch versions before 7
osv·2021-05-13·CVSS 5.3
CVE-2021-22135 [MEDIUM] CVE-2021-22135: Elasticsearch versions before 7
Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.
Red Hat
elasticsearch: Document disclosure flaw in the Elasticsearch suggester
vendor_redhat·2021-03-23·CVSS 5.3
CVE-2021-22135 [MEDIUM] CWE-200 elasticsearch: Document disclosure flaw in the Elasticsearch suggester
elasticsearch: Document disclosure flaw in the Elasticsearch suggester
Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.
Statement: In Elasticsearch, Document and Field Level Security is an enterprise only feature [1]. Hence the open source version is unaffected by this vulnerability.
[1] https://www.elastic.co/subscriptions
Package: openshift-logging/elasticsea
No detection rules found.
No public exploits indexed.
2021-05-13
Published