Information Exposure Affecting org.elasticsearch:elasticsearch Open this link in a new tab package, versions [7.6.0, 7.11.0)


0.0
low
  • Attack Complexity

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-JAVA-ORGELASTICSEARCH-1083274

  • published

    9 Mar 2021

  • disclosed

    9 Mar 2021

  • credit

    Unknown

How to fix?

Upgrade org.elasticsearch:elasticsearch to version 7.11.0 or higher.

Overview

org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine.

Affected versions of this package are vulnerable to Information Exposure when Document or Field Level Security is used. GET requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view.