CVE-2021-22146

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters

published July 21, 2021

CVSS
—
EPSS
36%
Percentile
98.5
In the wild
Unconfirmed
What it is

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.35781 · 98.5th percentile
Published
2021-07-21T11:28Z
EPSS history
Timeline
  • 21 JUL 11:28Z
    All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters
    cvelistv5