CVE-2021-22132

{"id": "CVE-2021-22132", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2021-01-14T20:15:13.407", "references": [{"url": "https://discuss.elastic.co/t/elasticsearch-7-10-2-security-update/261164", "tags": ["Release Notes", "Vendor Advisory"], "source": "bressers@elastic.co"}, {"url": "https://security.netapp.com/advisory/ntap-20210219-0004/", "tags": ["Third Party Advisory"], "source": "bressers@elastic.co"}, {"url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "tags": ["Patch", "Third Party Advisory"], "source": "bressers@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}, {"type": "Secondary", "source": "bressers@elastic.co", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2"}, {"lang": "es", "value": "Elasticsearch versiones 7.7.0 hasta 7.10.1, contienen un fallo de divulgaci\u00f3n de informaci\u00f3n en la API de b\u00fasqueda as\u00edncrona. Los usuarios que ejecutan una b\u00fasqueda as\u00edncrona almacenar\u00e1n inapropiadamente los encabezados HTTP. Un usuario de Elasticsearch con la capacidad de leer el \u00edndice .tasks podr\u00eda obtener encabezados de petici\u00f3n confidenciales de otros usuarios en el cl\u00faster. Este problema es corregido en Elasticsearch versi\u00f3n 7.10.2"}], "lastModified": "2022-05-12T14:52:03.583", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB1F6EA5-5747-4DB0-BD17-148468730A3F", "versionEndExcluding": "7.10.2", "versionStartIncluding": "7.7.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98FB24DB-AF91-48D0-9CA5-C8250D183FD5"}], "operator": "OR"}]}], "sourceIdentifier": "bressers@elastic.co"}