CVE-2021-22135CWE-200

Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and…

published May 13, 2021

CVSS
—
EPSS
1%
Percentile
71.1
In the wild
Unconfirmed
What it is

Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01342 · 71.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-05-13T17:35Z
EPSS history
Timeline
  • 13 MAY 17:35Z
    Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and…
    cvelistv5