CVE-2021-22137 : In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw wa

In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

Published 2021-05-13 18:15:09

Updated 2022-11-04 18:30:49

Source Elastic

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2021-22137

Elastic » Elasticsearch
Versions before (<) 6.8.15
cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*
Matching versions
Elastic » Elasticsearch
Versions from including (>=) 7.11.0 and before (<) 7.11.2
cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-22137

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 38 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-22137

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2021-22137

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: bressers@elastic.co (Secondary)
CWE-281 Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-22137

https://security.netapp.com/advisory/ntap-20210625-0003/

May 2021 Elasticsearch Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125

Elastic Stack 7.12.0 and 6.8.15 Security Update - Announcements / Security Announcements - Discuss the Elastic Stack
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-22137

Products affected by CVE-2021-22137

Exploit prediction scoring system (EPSS) score for CVE-2021-22137

CVSS scores for CVE-2021-22137

CWE ids for CVE-2021-22137

References for CVE-2021-22137