The Telegraph newspaper exposed 10TB of subscriber data

By Deeba Ahmed The data was exposed due to an unprotected Elasticsearch cluster and remained open to public access without any security authentication. This is a post from HackRead.com Read the original post: The Telegraph newspaper exposed 10TB of subscriber data...

Elastic: CVE-2021-40870 on [52.204.160.31]

An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal. The IP has a SSL certificate pointing to ElasticSearch. curl -kv...

Elastic Elasticsearch Installed (Linux)

Binary data elasticelasticsearchnixinstalled.nbin...

Security Bulletin: Multiple vulnerabilities may affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) offline documentation

Summary IBM Business Process Manager and IBM Business Automation Workflow offline documentation packages open source libraries with known vulnerabilities. Do not install offline documentation and remove existing installations with the fix provided below. Vulnerability Details CVEID: CVE-2021-2335...

Security Bulletin: IBM Security SOAR is using a version of Elasticsearch that has known vulnerabilities (CVE-2021-22137, CVE-2021-22135)

Summary IBM Security SOAR is using a version of Elasticsearch that has known vulnerabilities. A recent update has addressed these issues. Vulnerability Details CVEID: CVE-2021-22137 DESCRIPTION: Elasticsearch could allow a remote authenticated attacker to obtain sensitive information, caused by a...

Elastic Elasticsearch Privilege Escalation Vulnerability (ESA-2021-25)

Elastic Elasticsearch is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GHSA-J8WC-GXX9-82HX vulnerabilities

Vulnerabilities for packages: elasticsearch...

Exposure of sensitive information in Elasticsearch

A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

GHSA-45H5-R968-5XR7 Exposure of sensitive information in Elasticsearch

A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

cc.vihackerframework:vihacker-elasticsearch-starter (>=1.0.4.R <=1.0.8.R), cn.codeforfun:discovery-client-elasticsearch (>=1.0.2 <=1.0.5) +164 more potentially affected by CVE-2021-22147 via org.elasticsearch:elasticsearch (>=7.11.0 <=7.13.4)

org.elasticsearch:elasticsearch MAVEN version =7.11.0, =1.0.4.R, =1.0.2, =0.1.3-alpha, =0.1.3-alpha, =1.0.0-RELEASE, =1.0.0-RELEASE, =1.0.0-RELEASE, =0.6.0, =1.2.0, =1.2.0, =1.8.3, =1.45.0-rc.2 and more Source cves: CVE-2021-22147 Source advisory: OSV:GHSA-45H5-R968-5XR7...

CVE-2021-40690 vulnerabilities

Vulnerabilities for packages: elasticsearch...

Information Disclosure

elasticsearch is vulnerable to information disclosure. The vulnerability exists due to lack of security level applied to searchable snapshots, allowing an attacker to gain access to unauthorized information...

Elastic Elasticsearch Information Disclosure Vulnerability (ESA-2021-18)

Elasticsearch is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2021-22147

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

CVE-2021-22147

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

Information disclosure

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

CVE-2021-22147

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

UBUNTU-CVE-2021-22147

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

CVE-2021-22147

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...

CVE-2021-22147

CVE-2021-22147 affects Elasticsearch versions 7.11.0–7.13.4 where document and field level security is not applied to searchable snapshots, allowing an authenticated user to view information they are not authorized to see. The issue stems from a missing security enforcement in searchable snapshot...