CVE-2020-7020
- State
- Published
- Severity
- Not scored
- Published
- Oct 22, 2020
- Updated
- Aug 4, 2024
- Reserved
- Jan 14, 2020
Description
Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.
Scores
The record has no CVSS score.
Weaknesses
- CWE-270 Privilege Context Switching Error
Affected Products
| Product | Versions |
|---|---|
ElasticsearchElastic |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.