PT-2020-19345 · Elastic · Elasticsearch

Published 2020-10-22 · Updated 2024-03-06 · CVE-2020-7020

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 6.8.13 Elasticsearch versions prior to 7.9.2

Description The issue is related to a document disclosure flaw when Document or Field Level Security is used in Elasticsearch. Search queries do not properly preserve security permissions when executing certain complex queries, potentially disclosing the existence of documents that an attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

Recommendations For versions prior to 6.8.13, update to version 6.8.13 or later to resolve the issue. For versions prior to 7.9.2, update to version 7.9.2 or later to resolve the issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

CWE-270

Related Identifiers

BIT-ELASTICSEARCH-2020-7020

CVE-2020-7020

GHSA-G9FW-9X87-RMRJ

Affected Products

Elasticsearch

References · 12

• https://osv.dev/vulnerability/GHSA-g9fw-9x87-rmrj · Vendor Advisory
• https://staging-website.elastic.co/community/security · Vendor Advisory
• https://discuss.elastic.co/t/elastic-stack-7-9-3-and-6-8-13-security-update/253033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7020 · Security Note
• https://ubuntu.com/security/CVE-2020-7020 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7020 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7020 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-elasticsearch-2020-7020 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7020 · Security Note
• https://github.com/elastic/elasticsearch · Note
• https://security.netapp.com/advisory/ntap-20201123-0001 · Note
• https://t.me/cvenotify/6002 · Telegram Post