CVE-2021-22134

A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view.

• CWE-200
• CWE-863

• https://discuss.elastic.co/t/elastic-stack-7-11-0-security-update/265835Release Notes, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210430-0006/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://discuss.elastic.co/t/elastic-stack-7-11-0-security-update/265835Release Notes, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210430-0006/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory

Published

Mar 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22129Multiple instances of incorrect calculation of buffer size i…8.8
• CVE-2021-2213Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-22130A stack-based buffer overflow vulnerability in FortiProxy ph…4.9
• CVE-2021-22131A improper validation of certificate with host mismatch in F…5.4
• CVE-2021-22132Elasticsearch versions 7.7.0 to 7.10.1 contain an informatio…4.8
• CVE-2021-22133The Elastic APM agent for Go versions before 1.11.0 can leak…2.4
• CVE-2021-22135Elasticsearch versions before 7.11.2 and 6.8.15 contain a do…5.3
• CVE-2021-22136In Kibana versions before 7.12.0 and 6.8.15 a flaw in the se…3.5
• CVE-2021-22137In Elasticsearch versions before 7.11.2 and 6.8.15 a documen…5.3
• CVE-2021-22138In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.…3.7
• CVE-2021-22139Kibana versions before 7.12.1 contain a denial of service vu…6.5
• CVE-2021-2214Vulnerability in the Oracle WebLogic Server product of Oracl…4.4