CVE-2020-7021: Medium severity elastic vulnerability
Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emitrequestbody option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-7021?
CVE-2020-7021 is a vulnerability in Elasticsearch versions before 7.10.0 and 6.8.14 that allows for information disclosure when audit logging and the emit_request_body option is enabled.
What is the severity of CVE-2020-7021?
The severity of CVE-2020-7021 is medium.
How does CVE-2020-7021 affect Elasticsearch?
CVE-2020-7021 affects Elasticsearch versions before 7.10.0 and 6.8.14 by potentially exposing sensitive information such as password hashes or authentication tokens in the Elasticsearch audit log.
How can I fix CVE-2020-7021?
To fix CVE-2020-7021, it is recommended to upgrade Elasticsearch to version 7.10.0 or 6.8.14, or apply the necessary security updates provided by Elastic.
Are there any references for CVE-2020-7021?
Yes, you can find more information about CVE-2020-7021 at the following references: [1] [2]