CVE-2021-22134
mediumPriorität · verfolgen · 17OT-Risiko · erhöhtEPSS 0.011 · 66. PerzentilEUUSEPSS · bewertet 2026-10-27
A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (5)
Betroffene Produkte und Versionsbereiche.
- oracle communications cloud native core automated test suite= 1.8.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:*:*:*:*:*:*:*:*
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-hwvv-438r-mhvjExposure of Sensitive Information to an Unauthorized Actor2021-03-18ghsa · osvUS
A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view.
- BIT-elasticsearch-2021-221342024-03-06vendor · osvUS
A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202103-040cnnvd
- EUVD-2021-0675enisa_euvd
- GHSA-hwvv-438r-mhvjenisa_euvd
- BIT-elasticsearch-2021-22134osv
- GHSA-hwvv-438r-mhvjosv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (11)
Externe Belege — Patches, Meldungen, Analysen.
- https://discuss.elastic.co/t/elastic-stack-7-11-0-security-update/265835cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-22134cnnvd
- https://security.netapp.com/advisory/ntap-20210430-0006/cnnvd
- https://vigilance.fr/vulnerability/Elasticsearch-information-disclosure-via-Recently-Updated-Document-34717cnnvd
- https://www.oracle.com/security-alerts/cpuapr2022.htmlcnnvd
- https://discuss.elastic.co/t/elastic-stack-7-11-0-security-update/265835enisa_euvd
- https://security.netapp.com/advisory/ntap-20210430-0006/enisa_euvd
- https://www.oracle.com/security-alerts/cpuapr2022.htmlenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan