VulnerabilityModified

CVE-2021-37940

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integration.

MEDIUM 6.8EPSS 0.85%

Does this matter?

Lower severity and a low EPSS score (0.85%). Track it; it rarely justifies an emergency change on its own.

Description

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integration. Using this vulnerability, a malicious Workplace Search admin could use the GHES integration to view hosts that might not be publicly accessible.

CVSS 3.1: 6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
EPSS: 0.85% probability · 56th percentile
CISA KEV: Not listed
Weakness: CWE-918
Affected: elastic/enterprise search
Source: security@elastic.co

References

https://discuss.elastic.co/t/enterprise-search-7-16-0-security-update/291146Vendor Advisory
https://discuss.elastic.co/t/enterprise-search-7-16-0-security-update/291146Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.