CVE-2020-7011

https://notcve.org/view.php?id=CVE-2020-7011

Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be rendered by the web browser. If an attacker is able to control the contents of such a field, they could execute arbitrary JavaScript in the victim�s web browser. Elastic App Search versiones anteriores a 7.7.0, contienen un fallo de tipo cross site scripting (XSS) cuando se muestran las URL de los documentos en la Interfaz de Usuario Reference. Si la Interfaz de Usuario Reference inyecta una URL en un resultado, esa URL será representada por el navegador web. • https://www.elastic.co/community/security • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page •