CVE-2021-22147

Description

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.314

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-22147 are fixed in Elasticsearch Core 7.14.0	Windows
Vulnerabilities CVE-2021-22147 are fixed in Elasticsearch Core for Linux 7.14.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234