CVE-2020-7011

2020-06-0317:55:43

CWE-84

elastic

www.cve.org

0.001 Low

EPSS

Percentile

33.8%

JSON

Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be rendered by the web browser. If an attacker is able to control the contents of such a field, they could execute arbitrary JavaScript in the victimï¿½s web browser.

CNA Affected

[
  {
    "product": "Elastic App Search",
    "vendor": "Elastic",
    "versions": [
      {
        "status": "affected",
        "version": "before 7.7.0"
      }
    ]
  }
]

References

www.elastic.co/community/security/

0.001 Low

EPSS

Percentile

33.8%

JSON

Related for CVELIST:CVE-2020-7011