Vulnerability · Published Jan 14, 2021 · Assigned by elastic
CVE-2021-22132
Medium 4.8
In plain English
A medium-severity security flaw in Elasticsearch from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)4.8Medium
Exploit odds (30 days)1.2%top 31.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.elasticsearch:elasticsearch | 7.10.2 | GHSA-5fvx-2jj3-6mff |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Elasticsearch | 7.7.0 to 7.10.1 |
Weakness: CWE-522
References
- https://discuss.elastic.co/t/elasticsearch-7-10-2-security-update/261164 x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210219-0004/ x_refsource_CONFIRM