CVE-2021-22145
mediumPriorität · beachten · 63EPSS 0.762 · 100. PerzentilExploit · funktionalEUUSEPSS · bewertet 2026-10-27
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (2)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- auxiliary/scanner/http/elasticsearch_memory_disclosureElasticsearch Memory Disclosurefunktional · metasploit
- EDB-50149ElasticSearch 7.13.3 - Memory disclosurePoC · exploit_db
betroffene Produkte (5)
Betroffene Produkte und Versionsbereiche.
- oracle communications cloud native core automated test suite= 1.8.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:*:*:*:*:*:*:*:*
- Maven org.elasticsearch.client:elasticsearch-rest-client7.10.0 → 7.13.4osvUSpkg:maven/org.elasticsearch.client/elasticsearch-rest-client
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-q394-h7f5-7f44Generation of Error Message Containing Sensitive Information in Elasticsearch2022-05-24ghsa · osvUS
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.
- BIT-elasticsearch-2021-221452024-03-06vendor · osvUS
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202107-1553cnnvd
- EUVD-2022-4866enisa_euvd
- GHSA-q394-h7f5-7f44enisa_euvd
- BIT-elasticsearch-2021-22145osv
- GHSA-q394-h7f5-7f44osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (21)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/issue/WLB-2021070134cnnvd
- https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-22145cnnvd
- https://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.htmlcnnvd
- https://security.netapp.com/advisory/ntap-20210827-0006/cnnvd
- https://vigilance.fr/vulnerability/Elasticsearch-information-disclosure-via-Error-Reporting-35940cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.4283cnnvd
- https://www.exploit-db.com/exploits/50149cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan