CVE-2021-22147

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732 CWE-862

Affected software

Vendor	Product	Versions
Elastic	Elasticsearch	versions 7.11.0 to 7.13.4

References

https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344Vendor Advisory
https://security.netapp.com/advisory/ntap-20211008-0002/Third Party Advisory
https://www.elastic.co/community/security/Vendor Advisory
https://discuss.elastic.co/t/elastic-stack-7-14-0-security-update/280344Vendor Advisory
https://security.netapp.com/advisory/ntap-20211008-0002/Third Party Advisory
https://www.elastic.co/community/security/Vendor Advisory

Timeline

Published: Sep 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-221488.8Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as CVE-2021-221498.8Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alte CVE-2021-22154.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.CVE-2021-221507.2It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml li CVE-2021-221514.3It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could CVE-2021-221525.5A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 CVE-2021-221537.3A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a CVE-2021-221545.3An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1 CVE-2021-221558.8An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) vers CVE-2021-221569.8An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Develop CVE-2021-221576.1Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.11.1 allows stored XSS.CVE-2021-221587.2The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML external entity (XXE) injection in the Web