CVE-2020-7020

Katalog CVE

CVSS 3.1 · Low EPSS 1,1%

Kerentanan Privilege Context Switching Error pada elasticsearch. Skor CVSS 3.1 3.1 (Low) menurut NVD.

Deskripsi (NVD)

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

Rincian

Terbit di NVD

22 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.1 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-270: Privilege Context Switching Error
CWE-269: Improper Privilege Management

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.elastic.co/t/elastic-stack-7-9-3-and-6-8-13-security-update/253033 release notes · advisory vendor
• https://staging-website.elastic.co/community/security/ permissions required · advisory vendor
• https://security.netapp.com/advisory/ntap-20201123-0001/ advisory pihak ketiga