Aller au contenu
en Se connecter
Non notée

CVE-2021-22140 Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the…

Description

Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of the host running the instance and obtain sensitive files.

Produits et versions touchés

Produit Versions touchées Corrigé en
Elastic App Search Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Elastic App Search

Les 2 CVE de Elastic App Search →
CVE-2020-7011 Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in… Non notée
Suivre cette CVE