CVEvulnerability
CVE-2021-22132
4.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-01-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:N/AC:H/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-522
Description
Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2
Affected configurations
• elastic elasticsearch (>= 7.7.0 < 7.10.2)
• oracle communications cloud native core automated test suite 1.8.0
Related
Weakness · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
References
- https://discuss.elastic.co/t/elasticsearch-7-10-2-security-update/261164 Release Notes, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20210219-0004/ Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://discuss.elastic.co/t/elasticsearch-7-10-2-security-update/261164 Release Notes, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20210219-0004/ Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory