CVE-2021-22140

{"id": "CVE-2021-22140", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-05-13T18:15:09.157", "references": [{"url": "https://discuss.elastic.co/t/7-12-1-security-update/271433", "tags": ["Vendor Advisory"], "source": "bressers@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}, {"type": "Secondary", "source": "bressers@elastic.co", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of the host running the instance and obtain sensitive files."}, {"lang": "es", "value": "Elastic App Search versiones posteriores a 7.11.0 y anteriores a 7.12.0, contienen un problema de inyecci\u00f3n de entidad externa XML (XXE) en la funcionalidad beta del rastreador web de App Search. Con este vector, un atacante cuyo sitio web est\u00e1 siendo rastreado por App Search podr\u00eda dise\u00f1ar un sitemap.xml malicioso para atravesar el sistema de archivos del host que ejecuta la instancia y obtener archivos confidenciales"}], "lastModified": "2021-05-21T18:09:36.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:elastic_app_search:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62D851B4-581B-40E6-8FBC-B98ACFEE7D9C", "versionEndExcluding": "7.12.0", "versionStartIncluding": "7.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "bressers@elastic.co"}