HIGH✓ PATCH🇬🇧 English

CVE-2021-22146

CVSS 7.5v3.1pub. 2021-07-21upd. 2024-11-21

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Elastic Elasticsearch

    APP
    Elastic
    7.13.3
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
CWE
Referencje

Powiązane podatności

CVE-2015-1427CRITICAL9.8⚠ KEVPL ✓ten sam produkt

Elasticsearch: ucieczka z sandboksa Groovy i zdalne wykonanie poleceń

CVE-2015-5377CRITICAL9.8PL ✓ten sam produkt

RCE w Elasticsearch przez protokół transportowy (przed wersją 1.6.1)

CVE-2014-3120HIGH8.1⚠ KEVten sam produkt

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers...

CVE-2026-72649HIGH8.8ten sam produkt

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote...

CVE-2026-72642HIGH8.8ten sam produkt

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a mo...