WaratekVRT Sign in

CVE-2021-22145 Elasticsearch

Affected softwareElasticsearch
Severity6.5 Medium CVSS 3.1 2 scores
Fixed in7.13.4
WeaknessInformation exposure (CWE-200)
Published21 Jul 2021
Updated17 Jun 2026

Description

A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.

CWE-209

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 2 indexed Published artifacts you can open, in Exploit-DB, Nuclei; first seen 2021-07-23.
  • EPSS 76% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.5% of all scored CVEs.
IndexArtifactStarsFirst seen
Exploit-DB ElasticSearch 7.13.3 - Memory disclosure 2021-07-23
Nuclei Elasticsearch 7.10.0-7.13.3 - Information Disclosure

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record active
Decided by The affected package being open source on Maven, so the fix can be read
Finding This CVE affects an open-source Java library published on Maven Central (Maven packages: org.elasticsearch.client:elasticsearch-rest-client), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on.

CVSS

6.5 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N NVD Primary published
CVSS 2.0 4.0 none AV:N/AC:L/Au:S/C:P/I:N/A:N NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.elasticsearch.client:elasticsearch-rest-client 7.10.0 7.13.4 unbounded

Products and versions

3 products, 3 version entries
SourceVendorProductSchemeAffected versions
nvd elastic elasticsearch generic ≥ 7.10.0 and ≤ 7.13.3
nvd oracle communications cloud native core automated test suite generic 1.8.0
osv org.elasticsearch.client elasticsearch-rest-client generic ≥ 7.10.0 and ＜ 7.13.4

References

URLTags
https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177 WEB
https://gist.github.com/lucasdrufva/f9c5d7c9e26ee087b736d727953afd34 WEB
https://github.com/elastic/elasticsearch PACKAGE
https://security.netapp.com/advisory/ntap-20210827-0006 WEB
https://www.oracle.com/security-alerts/cpuapr2022.html WEB
http://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.html WEB
https://security.netapp.com/advisory/ntap-20210827-0006/ Third Party Advisory

Timeline
Published2021-07-21By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.