← Back

CVE-2021-22146

nvd nist
Published: Jul 21, 2021Modified: Nov 21, 2024

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.

Affected (1)

Elastic
1 product
Elasticsearch
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Elasticsearch
Version 7.13.3

References (6)

Source: security@elastic.co
ExploitThird Party AdvisoryVDB Entry
Source: security@elastic.co
Vendor Advisory
Source: security@elastic.co
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.