Auth bypass in Elastic Elasticsearch
CVE-2021-22147
Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.
EPSS: 0.010 (60.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Elastic Elasticsearch — versions versions 7.11.0 to 7.13.4
Weakness classification (CWE)
References
- security@elastic.co (x_refsource_MISC, Vendor Advisory)
- security@elastic.co (x_refsource_MISC, Vendor Advisory)
- security@elastic.co (x_refsource_CONFIRM, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-22147?
- CVE-2021-22147 is a medium-severity vulnerability in Elastic Elasticsearch, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 6.5/10. Published 2021-09-15.
- How severe is CVE-2021-22147?
- Medium severity. CVSS v3 base score is 6.5 out of 10.