CVE-2020-7019
- State
- Published
- Severity
- Not scored
- Published
- Aug 18, 2020
- Updated
- Aug 4, 2024
- Reserved
- Jan 14, 2020
Description
In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attacker gaining additional permissions against a restricted index.
Scores
The record has no CVSS score.
Weaknesses
- CWE-270 Privilege Context Switching Error
Affected Products
| Product | Versions |
|---|---|
ElasticsearchElastic |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.