GitHub Advisoryadvisory · Maven

GHSA-c77j-p484-h84m Improper privilege management in elasticsearch

MEDIUM Published 2022-05-24 Modified 2023-06-16 Official page ↗
Aliases
CVE-2020-7019
Ecosystem
Maven
Packages
org.elasticsearch:elasticsearch
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-269
Reviewed
2023-06-16

Affected packages

• Maven org.elasticsearch:elasticsearch: >= 7.0.0, < 7.9.0 → fixed in 7.9.0 • Maven org.elasticsearch:elasticsearch: < 6.8.12 → fixed in 6.8.12

Description

In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attacker gaining additional permissions against a restricted index.

Related

Alias · CVE (1)

  • CVE-2020-7019 In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References