CVE-2021-22140CWE-611

Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature

published May 13, 2021

CVSS
—
EPSS
1%
Percentile
69.6
In the wild
Unconfirmed
What it is

Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of the host running the instance and obtain sensitive files.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01270 · 69.6th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2021-05-13T17:35Z
EPSS history
Timeline
  • 13 MAY 17:35Z
    Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature
    cvelistv5