CVE-2020-7019: elastic elasticsearch Privilege Context Switching Error
Vulnerability summary
CVE-2020-7019 is a medium (CVSS 6.5) Privilege Context Switching Error vulnerability in elastic elasticsearch. EPSS estimates a 1.40% chance of exploitation in the next 30 days, higher than 72.1% of scored vulnerabilities.
Timeline
- 18-08-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attacker gaining additional permissions against a restricted index.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · MavenEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.40%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
+0.20 pp
From 1.20% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-270Privilege Context Switching ErrorThe product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Elastic1 product
- elasticsearch< 7.9.0 | < 6.8.12 | ≥ 7.0.0, < 7.9.0
Org.elasticsearch1 product
- elasticsearch≥ 7.0.0, < 7.9.0 | < 6.8.12
Ubuntu1 product
- elasticsearchAll versions (No fix recorded)
3 vendors · 3 products
References
7 links- discuss.elastic.co/t/elastic-stack-7-9-0-and-6-8-12-security-update/245456X Refsource MISCREPORTWEBVendor Advisory
