GitHub Advisoryadvisory · Maven

GHSA-5fvx-2jj3-6mff Insufficiently Protected Credentials in Elasticsearch

MEDIUM Published 2021-03-18 Modified 2021-03-16 Official page ↗
Aliases
CVE-2021-22132
Ecosystem
Maven
Packages
org.elasticsearch:elasticsearch
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-522
Reviewed
2021-03-16

Affected packages

• Maven org.elasticsearch:elasticsearch: >= 7.7.0, < 7.10.2 → fixed in 7.10.2

Description

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2

Related

Alias · CVE (1)

  • CVE-2021-22132 Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References