CVE-2021-22145

Katalog CVE

CVSS 6.5 · Medium EPSS 76,2%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada elasticsearch, oracle communications cloud native core automated test suite. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.

Rincian

Terbit di NVD

21 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

76,2% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177 advisory vendor
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.html exploit · advisory pihak ketiga · vdb entry
• https://security.netapp.com/advisory/ntap-20210827-0006/ advisory pihak ketiga
• https://gist.github.com/lucasdrufva/f9c5d7c9e26ee087b736d727953afd34