Improper Preservation of Permissions in Elasticsearch - CVE-2021-22137
Published: March 25, 2021 / Updated: October 19, 2022
Vulnerability identifier: #VU51712
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-22137
CWE-ID: CWE-281
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to search queries do not properly preserve security permissions when executing certain cross-cluster search queries. A remote user can disclose existence of documents via search functionality, when Document or Field Level Security is used.
Affected software
Elasticsearch
Red Hat Integration Camel Extensions for Quarkus
Red Hat Integration Camel-K
IBM Security SOAR
Junos Space Security Director
Red Hat Integration Camel Extensions for Quarkus
Red Hat Integration Camel-K
IBM Security SOAR
Junos Space Security Director
How to mitigate CVE-2021-22137
Install updates from vendor's website.
Elasticsearch - addressed in versions 6.8.15, 7.11.2
IBM Security SOAR - update to 42.0.7058
Red Hat Integration Camel-K - update to 1.8
Junos Space Security Director - update to 24.1R3
IBM Security SOAR - update to 42.0.7058
Red Hat Integration Camel-K - update to 1.8
Junos Space Security Director - update to 24.1R3