CVE-2021-22132

MEDIUM Year: 2021
CVSS v3 Score
4.8
Medium
CVSS v2 Score
2.1
Low
Weakness Type
CWE-522
View all →

Vulnerability Description

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2

Related Vulnerabilities

CVE-2024-47588

MEDIUM
CVSS:4.7(Medium)

In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext to a log file. An attacker with local acce...

CWE-5222024

CVE-2018-16984

MEDIUM
CVSS:4.9(Medium)

An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an...

CWE-5222018

CVE-2018-9279

MEDIUM
CVSS:4.9(Medium)

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the user's password. The web page displayed by the appliance contains the password in cleartext. Passwords could be re...

CWE-5222018

CVE-2018-9280

MEDIUM
CVSS:4.9(Medium)

An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the SNMP version 3 user's password. The web page displayed by the appliance contains the password in cleartext. Passwo...

CWE-5222018

CVE-2019-13349

MEDIUM
CVSS:4.9(Medium)

In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.

CWE-5222019

CVE-2019-13421

MEDIUM
CVSS:4.9(Medium)

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database.

CWE-5222019