Information Exposure Affecting org.elasticsearch:elasticsearch package, versions [7.6.0, 7.11.0)

  • Attack Complexity


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    9 Mar 2021

  • disclosed

    9 Mar 2021

  • credit


How to fix?

Upgrade org.elasticsearch:elasticsearch to version 7.11.0 or higher.


org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Information Exposure when Document or Field Level Security is used. GET requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view.