CVE-2020-7019

Katalog CVE

CVSS 6.5 · Medium EPSS 1,4%

Kerentanan Privilege Context Switching Error pada elasticsearch. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attacker gaining additional permissions against a restricted index.

Rincian

Terbit di NVD

18 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-270: Privilege Context Switching Error
CWE-269: Improper Privilege Management

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.elastic.co/t/elastic-stack-7-9-0-and-6-8-12-security-update/245456 advisory vendor
• https://security.netapp.com/advisory/ntap-20200827-0001/ advisory pihak ketiga