Elastic App Search vulnerabilities

2 CVEs affecting Elastic App Search, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22140, published 2021-05-13.

More from Elastic.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-22140, published 2021-05-13. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose…
• CVE-2020-7011, published 2020-06-03. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be…