Information Exposure Affecting org.elasticsearch:elasticsearch package, versions [7.6.0, 7.11.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGELASTICSEARCH-1083274
- published 9 Mar 2021
- disclosed 9 Mar 2021
- credit Unknown
Introduced: 9 Mar 2021
CVE-2021-22134 Open this link in a new tabHow to fix?
Upgrade org.elasticsearch:elasticsearch to version 7.11.0 or higher.
Overview
org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.
Affected versions of this package are vulnerable to Information Exposure when Document or Field Level Security is used. GET requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view.