CVE-2020-7020

Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 6.8.13 Elasticsearch versions prior to 7.9.2

Description The issue is related to a document disclosure flaw when Document or Field Level Security is used in Elasticsearch. Search queries do not properly preserve security permissions when executing certain complex queries, potentially disclosing the existence of documents that an attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

Recommendations For versions prior to 6.8.13, update to version 6.8.13 or later to resolve the issue. For versions prior to 7.9.2, update to version 7.9.2 or later to resolve the issue.