UpHeron
All vulnerabilities

Servers and applications

CVE-2021-22135

Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to…

Severity
Medium 5.3
Published
13 May 2021
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
6.8.15, 7.11.2
Sources
NVD

Affected software

SoftwareAffected versions
ElasticsearchServers and applications · cpe:a:elastic:elasticsearch
  • Every version before 6.8.15
  • From 7.11.0 before 7.11.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-22135
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-22135