Information Disclosure Affecting org.elasticsearch:elasticsearch package, versions [,6.8.14) [7.0.0-alpha1,7.10.0)
Threat Intelligence
EPSS
0.07% (30th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGELASTICSEARCH-1071900
- published 11 Feb 2021
- disclosed 11 Feb 2021
- credit Unknown
Introduced: 11 Feb 2021
CVE-2020-7021 Open this link in a new tabHow to fix?
Upgrade org.elasticsearch:elasticsearch to version 6.8.14, 7.10.0 or higher.
Overview
org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.
Affected versions of this package are vulnerable to Information Disclosure. There is an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.
References
CVSS Scores
version 3.1