Vulnerabilities > CVE-2021-37940 - Server-Side Request Forgery (SSRF) vulnerability in Elastic Enterprise Search

047910
CVSS 4.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
elastic
CWE-918
NVD
Published: 2021-12-07
Updated: 2021-12-09

Summary

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integration. Using this vulnerability, a malicious Workplace Search admin could use the GHES integration to view hosts that might not be publicly accessible.

Vulnerable Configurations

Part Description Count
Application
Elastic
26

Common Weakness Enumeration (CWE)

References