PT-2021-14871 · Elastic · Elasticsearch

Published 2021-09-15 · Updated 2024-03-06 · CVE-2021-22147

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions prior to 7.14.0

Description: A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.

Recommendations: For versions prior to 7.14.0, update to version 7.14.0 or later to resolve the issue. As a temporary workaround, consider restricting access to searchable snapshots until a patch is available.

Fix

Missing Authorization

Incorrect Permission

Weakness Enumeration

CWE-862

CWE-732

Related Identifiers

BIT-ELASTICSEARCH-2021-22147

CVE-2021-22147

GHSA-45H5-R968-5XR7

Affected Products

Elasticsearch

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2021-22147 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-22147 · Security Note
• https://ubuntu.com/security/CVE-2021-22147 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22147 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22147 · Vendor Advisory
• https://elastic.co/community/security · Vendor Advisory
• https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-45h5-r968-5xr7 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-elasticsearch-2021-22147 · Vendor Advisory
• https://t.me/cvenotify/25582 · Telegram Post
• https://security.netapp.com/advisory/ntap-20211008-0002 · Note
• https://t.me/cvenotify/22161 · Telegram Post
• https://t.me/cvenotify/21454 · Telegram Post