CVE-2020-7021

    Dashboard / Vulnerabilities / CVE-2020-7021

    CVE-2020-7021

    Published: 10 Feb 2021Last Modified: 8 Jul 2026

    Summary:

    Details: Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.

    References: https://discuss.elastic.co/t/elastic-stack-7-11-0-and-6-8-14-security-update/263915, https://security.netapp.com/advisory/ntap-20210319-0003/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -dab5822e9f9888f3e71aaca22e1faecce73706f6

    Affected versions

    v6.8.13
    v6.8.12
    v6.8.11
    v6.8.10
    v6.8.9
    v6.8.8
    v6.8.7
    v6.8.6
    v6.8.5
    v6.8.4
    v6.8.3
    v6.8.2
    v6.8.1
    v6.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-7021 | CVE-DB