CVE-2021-22132CWE-522

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API

published January 14, 2021

CVSS
—
EPSS
1%
Percentile
68.5
In the wild
Unconfirmed
What it is

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01222 · 68.5th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2021-01-14T19:20Z
EPSS history
Timeline
  • 14 JAN 19:20Z
    Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API
    cvelistv5