CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2021-22147
Medium (6.5) in elastic elasticsearch. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in org.elasticsearch:elasticsearch 7.14.0.
Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-862, CWE-732
- Published
- Modified
- Record from
- the NVD, synced
Affected
- elastic:elasticsearch
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-45h5-r968-5xr7 | Maven | org.elasticsearch:elasticsearch | >=7.11.0 <7.14.0 | 7.14.0 |