Vulnerability · Published May 13, 2021 · Assigned by elastic
CVE-2021-22140
High 7.5
In plain English
A high-severity XML external entity in Elastic App Search from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.3%top 30.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of the host running the instance and obtain sensitive files.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Elastic App Search | after 7.11.0 and before 7.12.0 |
Weakness: CWE-611
References
- https://discuss.elastic.co/t/7-12-1-security-update/271433 x_refsource_MISC