CVE-2021-22137

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-281

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-221383.7In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When sp CVE-2021-221396.5Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit CVE-2021-22144.4Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected a CVE-2021-221407.5Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawle CVE-2021-221416.1An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could CVE-2021-221428.8Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user CVE-2021-221434.3The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the AP CVE-2021-221446.5In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was CVE-2021-221456.5A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitr CVE-2021-221467.5All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the defaul CVE-2021-221476.5Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated use CVE-2021-221488.8Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as