Vulnerability · Published Jun 3, 2020 · Assigned by elastic
CVE-2020-7011
Medium 6.1
In plain English
A medium-severity security flaw in Elastic App Search from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)1.0%top 36.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be rendered by the web browser. If an attacker is able to control the contents of such a field, they could execute arbitrary JavaScript in the victim�s web browser.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Elastic App Search | before 7.7.0 |
Weakness: CWE-84
References
- https://www.elastic.co/community/security/ x_refsource_MISC