medium6.5Public exploit code
CVE-2021-22145
Generation of Error Message Containing Sensitive Information in Elasticsearch
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ElasticSearch 7.13.3 - Memory disclosure2021-07-23 · webapps · multiple
Impact
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.elasticsearch.client:elasticsearch-rest-client | >= 7.10.0, <= 7.13.3 | 7.13.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Elastic | Elasticsearch | from 7.10.0 through 7.13.3 |
| Oracle | Communications Cloud Native Core Automated Test Suite | Version 1.8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.html
- https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177
- https://gist.github.com/lucasdrufva/f9c5d7c9e26ee087b736d727953afd34
- https://security.netapp.com/advisory/ntap-20210827-0006/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://github.com/advisories/GHSA-q394-h7f5-7f44
- https://nvd.nist.gov/vuln/detail/CVE-2021-22145
- https://security.netapp.com/advisory/ntap-20210827-0006