CVE-2021-22147: Medium severity elastic vulnerability
Published Sep 15, 2021
·Updated
Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.
Affected Software
1 affected component
Elastic Elasticsearch>=7.11.0<7.14.0
Event History
Sep 15, 2021
CVE Published
via MITRE·11:36 AM
Data Sourced
via MITRE·11:36 AM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2021-22147?
CVE-2021-22147 is a vulnerability in Elasticsearch versions before 7.14.0 that allowed an authenticated user to access unauthorized information in searchable snapshots.
2
How does CVE-2021-22147 impact Elasticsearch?
CVE-2021-22147 impacted Elasticsearch versions before 7.14.0 by not applying document and field level security to searchable snapshots.
3
What is the severity of CVE-2021-22147?
CVE-2021-22147 has a severity value of 6.5, which is considered medium.
4
What is the Common Weakness Enumeration (CWE) for CVE-2021-22147?
The CWE for CVE-2021-22147 is CWE-862 and CWE-732.
5
How can I fix CVE-2021-22147?
To fix CVE-2021-22147, you should update Elasticsearch to version 7.14.0 or later.