CVE-2020-7019

Description

In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attacker gaining additional permissions against a restricted index.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.111

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-7019 are fixed in Elasticsearch Core 7.9.0	Windows
Vulnerabilities CVE-2020-7019 are fixed in Elasticsearch Core 6.8.12	Windows
Vulnerabilities CVE-2020-7019 are fixed in Elasticsearch Core for Linux 7.9.0	Linux
Vulnerabilities CVE-2020-7019 are fixed in Elasticsearch Core for Linux 6.8.12	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234