CVE-2021-22145
ElasticSearch 7.13.3 - Memory disclosure
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.
Se ha identificado una vulnerabilidad de divulgación de memoria en los informes de errores de Elasticsearch versiones 7.10.0 hasta 7.13.3. Un usuario con la habilidad de enviar consultas arbitrarias a Elasticsearch podría enviar una consulta malformada que resultaría en un mensaje de error devuelto conteniendo porciones previamente usadas de un buffer de datos. Este búfer podría contener información confidencial, como documentos de Elasticsearch o detalles de autenticación
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-04 CVE Reserved
- 2021-07-21 CVE Published
- 2021-07-23 First Exploit
- 2024-08-03 CVE Updated
- 2024-11-06 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-209: Generation of Error Message Containing Sensitive Information
CAPEC
References (6)
URL | Tag | Source |
---|---|---|
https://security.netapp.com/advisory/ntap-20210827-0006 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://www.exploit-db.com/exploits/50149 | 2021-07-23 | |
https://github.com/niceeeeeeee/CVE-2021-22145-poc | 2023-08-31 | |
http://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.html | 2024-08-03 |
URL | Date | SRC |
---|---|---|
https://www.oracle.com/security-alerts/cpuapr2022.html | 2022-05-10 |
URL | Date | SRC |
---|---|---|
https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177 | 2021-07-21 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Elastic Search vendor "Elastic" | Elasticsearch Search vendor "Elastic" for product "Elasticsearch" | >= 7.10.0 <= 7.13.3 Search vendor "Elastic" for product "Elasticsearch" and version " >= 7.10.0 <= 7.13.3" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Cloud Native Core Automated Test Suite Search vendor "Oracle" for product "Communications Cloud Native Core Automated Test Suite" | 1.8.0 Search vendor "Oracle" for product "Communications Cloud Native Core Automated Test Suite" and version "1.8.0" | - |
Affected
|