BIT-elasticsearch-2021-22147

vendorUSosv

view advisory published 2024-03-06Licence: per source

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-22147US	medium6.5OT elevated	1.04% (64th)	—	2021-09-15
Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that the…

references

External citations — patches, advisories, analysis.

https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2021-22147WEB
https://security.netapp.com/advisory/ntap-20211008-0002/ADVISORY
https://www.elastic.co/community/security/ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan