1. Home
  2. CVE Database
  3. CVE-2020-7019
MEDIUM · 6.5

CVE-2020-7019

In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recentl...

Vulnerability Description

In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attacker gaining additional permissions against a restricted index.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
ElasticElasticsearch< 6.8.12

Related Weaknesses (CWE)

CWE-269CWE-270

References

FAQ

What is CVE-2020-7019?

CVE-2020-7019 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recentl...

How severe is CVE-2020-7019?

CVE-2020-7019 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-7019?

Check the references section above for vendor advisories and patch information. Affected products include: Elastic Elasticsearch.