Vulnerabilities > CVE-2021-22137 - Improper Preservation of Permissions vulnerability in Elastic Elasticsearch

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

elastic

CWE-281

NVD

Published: 2021-05-13

Updated: 2022-11-04

Summary

In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

Vulnerable Configurations

Part	Description	Count
Application	Elastic Elastic Elasticsearch 0.4.0 Elastic Elasticsearch 0.5.0 Elastic Elasticsearch 0.5.1 Elastic Elasticsearch 0.6.0 Elastic Elasticsearch 0.7.0 Elastic Elasticsearch 0.7.1 Elastic Elasticsearch 0.8.0 Elastic Elasticsearch 0.9.0 Elastic Elasticsearch 0.10.0 Elastic Elasticsearch 0.11.0 Elastic Elasticsearch 0.12.0 Elastic Elasticsearch 0.12.1 Elastic Elasticsearch 0.13.0 Elastic Elasticsearch 0.13.1 Elastic Elasticsearch 0.14.0 Elastic Elasticsearch 0.14.1 Elastic Elasticsearch 0.14.2 Elastic Elasticsearch 0.14.3 Elastic Elasticsearch 0.14.4 Elastic Elasticsearch 0.15.0 Elastic Elasticsearch 0.15.1 Elastic Elasticsearch 0.15.2 Elastic Elasticsearch 0.16.0 Elastic Elasticsearch 0.16.1 Elastic Elasticsearch 0.16.2 Elastic Elasticsearch 0.16.3 Elastic Elasticsearch 0.16.4 Elastic Elasticsearch 0.16.5 Elastic Elasticsearch 0.17.0 Elastic Elasticsearch 0.17.1 Elastic Elasticsearch 0.17.2 Elastic Elasticsearch 0.17.3 Elastic Elasticsearch 0.17.4 Elastic Elasticsearch 0.17.5 Elastic Elasticsearch 0.17.6 Elastic Elasticsearch 0.17.7 Elastic Elasticsearch 0.17.8 Elastic Elasticsearch 0.17.9 Elastic Elasticsearch 0.17.10 Elastic Elasticsearch 0.18.0 Elastic Elasticsearch 0.18.1 Elastic Elasticsearch 0.18.2 Elastic Elasticsearch 0.18.3 Elastic Elasticsearch 0.18.4 Elastic Elasticsearch 0.18.5 Elastic Elasticsearch 0.18.6 Elastic Elasticsearch 0.18.7 Elastic Elasticsearch 0.19.0 Elastic Elasticsearch 0.19.1 Elastic Elasticsearch 0.19.2 Elastic Elasticsearch 0.19.3 Elastic Elasticsearch 0.19.4 Elastic Elasticsearch 0.19.5 Elastic Elasticsearch 0.19.6 Elastic Elasticsearch 0.19.7 Elastic Elasticsearch 0.19.8 Elastic Elasticsearch 0.19.9 Elastic Elasticsearch 0.19.10 Elastic Elasticsearch 0.19.11 Elastic Elasticsearch 0.19.12 Elastic Elasticsearch 0.20.0 Elastic Elasticsearch 0.20.1 Elastic Elasticsearch 0.20.2 Elastic Elasticsearch 0.20.3 Elastic Elasticsearch 0.20.4 Elastic Elasticsearch 0.20.5 Elastic Elasticsearch 0.20.6 Elastic Elasticsearch 0.90.0 Elastic Elasticsearch 0.90.1 Elastic Elasticsearch 0.90.2 Elastic Elasticsearch 0.90.3 Elastic Elasticsearch 0.90.4 Elastic Elasticsearch 0.90.5 Elastic Elasticsearch 0.90.6 Elastic Elasticsearch 0.90.7 Elastic Elasticsearch 0.90.8 Elastic Elasticsearch 0.90.9 Elastic Elasticsearch 0.90.10 Elastic Elasticsearch 0.90.11 Elastic Elasticsearch 0.90.12 Elastic Elasticsearch 0.90.13 Elastic Elasticsearch 1.0.0 Elastic Elasticsearch 1.0.1 Elastic Elasticsearch 1.0.2 Elastic Elasticsearch 1.0.3 Elastic Elasticsearch 1.1.0 Elastic Elasticsearch 1.1.1 Elastic Elasticsearch 1.1.2 Elastic Elasticsearch 1.2.0 Elastic Elasticsearch 1.2.1 Elastic Elasticsearch 1.2.2 Elastic Elasticsearch 1.2.3 Elastic Elasticsearch 1.2.4 Elastic Elasticsearch 1.3.0 Elastic Elasticsearch 1.3.1 Elastic Elasticsearch 1.3.2 Elastic Elasticsearch 1.3.3 Elastic Elasticsearch 1.3.4 Elastic Elasticsearch 1.3.5 Elastic Elasticsearch 1.3.6 Elastic Elasticsearch 1.3.7 Elastic Elasticsearch 1.3.8 Elastic Elasticsearch 1.3.9 Elastic Elasticsearch 1.4.0 Elastic Elasticsearch 1.4.1 Elastic Elasticsearch 1.4.2 Elastic Elasticsearch 1.4.3 Elastic Elasticsearch 1.4.4 Elastic Elasticsearch 1.4.5 Elastic Elasticsearch 1.5.0 Elastic Elasticsearch 1.5.1 Elastic Elasticsearch 1.5.2 Elastic Elasticsearch 1.6.0 Elastic Elasticsearch 1.6.1 Elastic Elasticsearch 1.6.2 Elastic Elasticsearch 1.7.0 Elastic Elasticsearch 1.7.1 Elastic Elasticsearch 1.7.2 Elastic Elasticsearch 1.7.3 Elastic Elasticsearch 1.7.4 Elastic Elasticsearch 1.7.5 Elastic Elasticsearch 1.7.6 Elastic Elasticsearch 2.0.0 Elastic Elasticsearch 2.0.1 Elastic Elasticsearch 2.0.2 Elastic Elasticsearch 2.1.0 Elastic Elasticsearch 2.1.1 Elastic Elasticsearch 2.1.2 Elastic Elasticsearch 2.2.0 Elastic Elasticsearch 2.2.1 Elastic Elasticsearch 2.2.2 Elastic Elasticsearch 2.3.0 Elastic Elasticsearch 2.3.1 Elastic Elasticsearch 2.3.2 Elastic Elasticsearch 2.3.3 Elastic Elasticsearch 2.3.4 Elastic Elasticsearch 2.3.5 Elastic Elasticsearch 2.4.0 Elastic Elasticsearch 2.4.1 Elastic Elasticsearch 2.4.2 Elastic Elasticsearch 2.4.3 Elastic Elasticsearch 2.4.4 Elastic Elasticsearch 2.4.5 Elastic Elasticsearch 2.4.6 Elastic Elasticsearch 5.0.0 Elastic Elasticsearch 5.0.1 Elastic Elasticsearch 5.0.2 Elastic Elasticsearch 5.1.1 Elastic Elasticsearch 5.1.2 Elastic Elasticsearch 5.2.0 Elastic Elasticsearch 5.2.1 Elastic Elasticsearch 5.2.2 Elastic Elasticsearch 5.3.0 Elastic Elasticsearch 5.3.1 Elastic Elasticsearch 5.3.2 Elastic Elasticsearch 5.3.3 Elastic Elasticsearch 5.4.0 Elastic Elasticsearch 5.4.1 Elastic Elasticsearch 5.4.2 Elastic Elasticsearch 5.4.3 Elastic Elasticsearch 5.5.0 Elastic Elasticsearch 5.5.1 Elastic Elasticsearch 5.5.2 Elastic Elasticsearch 5.5.3 Elastic Elasticsearch 5.6.0 Elastic Elasticsearch 5.6.1 Elastic Elasticsearch 5.6.2 Elastic Elasticsearch 5.6.3 Elastic Elasticsearch 5.6.4 Elastic Elasticsearch 5.6.5 Elastic Elasticsearch 5.6.6 Elastic Elasticsearch 5.6.7 Elastic Elasticsearch 5.6.8 Elastic Elasticsearch 5.6.9 Elastic Elasticsearch 5.6.10 Elastic Elasticsearch 5.6.11 Elastic Elasticsearch 5.6.12 Elastic Elasticsearch 5.6.13 Elastic Elasticsearch 5.6.14 Elastic Elasticsearch 5.6.15 Elastic Elasticsearch 5.6.16 Elastic Elasticsearch 6.0.0 Elastic Elasticsearch 6.0.1 Elastic Elasticsearch 6.1.0 Elastic Elasticsearch 6.1.1 Elastic Elasticsearch 6.1.2 Elastic Elasticsearch 6.1.3 Elastic Elasticsearch 6.1.4 Elastic Elasticsearch 6.2.0 Elastic Elasticsearch 6.2.1 Elastic Elasticsearch 6.2.2 Elastic Elasticsearch 6.2.3 Elastic Elasticsearch 6.2.4 Elastic Elasticsearch 6.3.0 Elastic Elasticsearch 6.3.1 Elastic Elasticsearch 6.3.2 Elastic Elasticsearch 6.4.0 Elastic Elasticsearch 6.4.1 Elastic Elasticsearch 6.4.2 Elastic Elasticsearch 6.4.3 Elastic Elasticsearch 6.5.0 Elastic Elasticsearch 6.5.1 Elastic Elasticsearch 6.5.2 Elastic Elasticsearch 6.5.3 Elastic Elasticsearch 6.5.4 Elastic Elasticsearch 6.6.0 Elastic Elasticsearch 6.6.1 Elastic Elasticsearch 6.6.2 Elastic Elasticsearch 6.7.0 Elastic Elasticsearch 6.7.1 Elastic Elasticsearch 6.7.2 Elastic Elasticsearch 6.8.0 Elastic Elasticsearch 6.8.1 Elastic Elasticsearch 6.8.2 Elastic Elasticsearch 6.8.3 Elastic Elasticsearch 6.8.4 Elastic Elasticsearch 6.8.5 Elastic Elasticsearch 6.8.6 Elastic Elasticsearch 6.8.7 Elastic Elasticsearch 6.8.8 Elastic Elasticsearch 6.8.9 Elastic Elasticsearch 6.8.10 Elastic Elasticsearch 6.8.11 Elastic Elasticsearch 6.8.12 Elastic Elasticsearch 6.8.13 Elastic Elasticsearch 6.8.14 Elastic Elasticsearch 7.11.0 Elastic Elasticsearch 7.11.1	264

Common Weakness Enumeration (CWE)

CWE-281 - Improper Preservation of Permissions

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References