CVE-2021-22140

Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of the host running the instance and obtain sensitive files.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://discuss.elastic.co/t/7-12-1-security-update/271433	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:elastic:elastic_app_search:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-05-13 18:15

Updated : 2024-02-28 18:28

NVD link : CVE-2021-22140

Mitre link : CVE-2021-22140

CVE.ORG link : CVE-2021-22140

JSON object : View

Products Affected

elastic

elastic_app_search

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2021-22140", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-05-13T18:15:09.157", "references": [{"url": "https://discuss.elastic.co/t/7-12-1-security-update/271433", "tags": ["Vendor Advisory"], "source": "bressers@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}, {"type": "Secondary", "source": "bressers@elastic.co", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of the host running the instance and obtain sensitive files."}, {"lang": "es", "value": "Elastic App Search versiones posteriores a 7.11.0 y anteriores a 7.12.0, contienen un problema de inyecci\u00f3n de entidad externa XML (XXE) en la funcionalidad beta del rastreador web de App Search. Con este vector, un atacante cuyo sitio web est\u00e1 siendo rastreado por App Search podr\u00eda dise\u00f1ar un sitemap.xml malicioso para atravesar el sistema de archivos del host que ejecuta la instancia y obtener archivos confidenciales"}], "lastModified": "2021-05-21T18:09:36.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:elastic_app_search:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62D851B4-581B-40E6-8FBC-B98ACFEE7D9C", "versionEndExcluding": "7.12.0", "versionStartIncluding": "7.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "bressers@elastic.co"}