Known vulnerabilities in Elasticsearch - page 3

Software: Elasticsearch
Software CPE: cpe:2.3:a:elastic_stack:elasticsearch:*:*:*:*:*:*:*:*
Total vulnerabilities: 53
Public exploits: 5
Known exploited (KEV): 1
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Elasticsearch Elasticsearch is affected by 53 known vulnerabilities: 2 high, 26 medium, 25 low Critical High Medium Low

Vulnerabilities (53)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU108112 - Improper Authentication
CVE-2016-11086
CWE-287 High
No
No
7.9.3 01.05.2025 SB2020092430
SB2020102234
#VU108109 - Permissions, Privileges, and Access Controls
CVE-2020-7020
CWE-264 Low
No
No
6.8.13, 7.9.3 01.05.2025 SB2020102234
SB2025050123
#VU51054 - Exposure of sensitive information to an unauthorized actor
CVE-2021-22134
CWE-200 Medium
No
No
7.11.0 02.03.2021 SB2021030214
#VU50604 - Information Exposure Through Log Files
CVE-2020-7021
CWE-532 Low
No
No
6.8.14, 7.10.0 11.02.2021 SB2021021101
SB2025050123
#VU26521 - Permissions, Privileges, and Access Controls
CVE-2020-7009
CWE-264 Medium
No
No
6.8.8, 7.6.2 01.04.2020 SB2020040158
SB20230418141
#VU21429 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2019-7614
CWE-362 Low
No
No
6.8.2, 7.2.1 30.09.2019 SB2019073108
#VU21419 - Exposure of sensitive information to an unauthorized actor
CVE-2018-3831
CWE-200 Medium
No
No
5.6.12, 6.4.1 30.09.2019 SB2018091905
#VU18086 - Improper Access Control
CVE-2019-7611
CWE-284 Low
No
No
5.6.15, 6.6.1 27.03.2019 SB2019032703
SB2019022504
SB2020031901
and 1 more
#VU16604 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2018-17247
CWE-611 Low
No
No
6.5.2 19.12.2018 SB2018121901
#VU36628 - Missing Encryption of Sensitive Data
CVE-2018-3826
CWE-311 Medium
No
No
- 19.09.2018 SB2018091907
#VU38510 - Permissions, Privileges, and Access Controls
CVE-2015-4165
CWE-264 Medium
No
No
- 09.08.2017 SB2017080923
#VU40798 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2015-3337
CWE-22 Medium
Available
No
1.4.5, 1.5.2 01.05.2015 SB2015050102
#VU40890 - Improper Access Control
CVE-2015-1427
CWE-284 Medium
Available
Exploited
- 17.02.2015 SB2015021703


Showing elements 41 - 60 out of 53