Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
- Snyk ID SNYK-JAVA-ORGELASTICSEARCH-1083274
- published 9 Mar 2021
- disclosed 9 Mar 2021
- credit Unknown
How to fix?
org.elasticsearch:elasticsearch to version 7.11.0 or higher.
org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.
Affected versions of this package are vulnerable to Information Exposure when Document or Field Level Security is used. GET requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view.