CVE-2021-22146

moderate-risk
Published 2021-07-21

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.

Do I need to act?

!
29.9% chance of exploitation in next 30 days
EPSS score — higher than 70% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
50152
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Elastic

References (6)

Exploit http://packetstormsecurity.com/files/163655/Elasticsearch-ECE-7.13.3-Database-Di...
Vendor Advisory https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180
Third Party Advisory https://security.netapp.com/advisory/ntap-20210819-0005/
Exploit http://packetstormsecurity.com/files/163655/Elasticsearch-ECE-7.13.3-Database-Di...
Vendor Advisory https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180
Third Party Advisory https://security.netapp.com/advisory/ntap-20210819-0005/
46
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 15/34 · Moderate
Exposure 5/34 · Minimal