GitHub Advisoryadvisory · Maven

GHSA-q394-h7f5-7f44 Generation of Error Message Containing Sensitive Information in Elasticsearch

MEDIUM Published 2022-05-24 Modified 2025-07-09 Official page ↗
Aliases
CVE-2021-22145
Ecosystem
Maven
Packages
org.elasticsearch.client:elasticsearch-rest-client
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-209
Reviewed
2022-06-22

Affected packages

• Maven org.elasticsearch.client:elasticsearch-rest-client: >= 7.10.0, < 7.13.4 → fixed in 7.13.4

Description

A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.

Related

Alias · CVE (1)

  • CVE-2021-22145 A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References