CVE-2021-22145
mediumpriority · attend · 63EPSS 0.762 · 100 %ileexploit · functionalEUUSEPSS · scored 2026-10-27
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- auxiliary/scanner/http/elasticsearch_memory_disclosureElasticsearch Memory Disclosurefunctional · metasploit
- EDB-50149ElasticSearch 7.13.3 - Memory disclosurePoC · exploit_db
affected products (5)
Products and version ranges known to be affected.
- oracle communications cloud native core automated test suite= 1.8.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:*:*:*:*:*:*:*:*
- Maven org.elasticsearch.client:elasticsearch-rest-client7.10.0 → 7.13.4osvUSpkg:maven/org.elasticsearch.client/elasticsearch-rest-client
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-q394-h7f5-7f44Generation of Error Message Containing Sensitive Information in Elasticsearch2022-05-24ghsa · osvUS
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.
- BIT-elasticsearch-2021-221452024-03-06vendor · osvUS
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.
also known as (5)
Other names and identifiers for this entity.
- CNNVD-202107-1553cnnvd
- EUVD-2022-4866enisa_euvd
- GHSA-q394-h7f5-7f44enisa_euvd
- BIT-elasticsearch-2021-22145osv
- GHSA-q394-h7f5-7f44osv
sources
Which sources assert this record, and when.
references (21)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/issue/WLB-2021070134cnnvd
- https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-22145cnnvd
- https://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.htmlcnnvd
- https://security.netapp.com/advisory/ntap-20210827-0006/cnnvd
- https://vigilance.fr/vulnerability/Elasticsearch-information-disclosure-via-Error-Reporting-35940cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.4283cnnvd
- https://www.exploit-db.com/exploits/50149cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan