Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field     Level Security is used. Search queries do not properly preserve security permissions when executing     certain complex queries. This could result in the search disclosing the existence of documents the     attacker should not be able to view. This could result in an attacker gaining additional insight into     potentially sensitive indices. (CVE-2020-7020)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field
    Level Security is used. Search queries do not properly preserve security permissions when executing
    certain complex queries. This could result in the search disclosing the existence of documents the
    attacker should not be able to view. This could result in an attacker gaining additional insight into
    potentially sensitive indices. (CVE-2020-7020)

An update of the elasticsearch package has been released.

ID	Name	Product	Family	Type	Severity
260331	Linux Distros Unpatched Vulnerability : CVE-2020-7020	Nessus	Misc.	Local	low
415029	SCA: security update for org.elasticsearch:elasticsearch (GHSA-g9fw-9x87-rmrj)	Tenable Cloud Security	SCA Checks	Local	low
415029	SCA: security update for org.elasticsearch:elasticsearch (GHSA-g9fw-9x87-rmrj)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
146483	Photon OS 2.0: Elasticsearch PHSA-2021-2.0-0317	Nessus	PhotonOS Local Security Checks	Local	low
144520	Photon OS 1.0: Elasticsearch PHSA-2020-1.0-0348	Nessus	PhotonOS Local Security Checks	Local	low
143447	Photon OS 3.0: Elasticsearch PHSA-2020-3.0-0166	Nessus	PhotonOS Local Security Checks	Local	low

Detections

Analytics

CVE-2020-7020

low

Tenable Plugins

low

low

low

low

low

low