Sign in
Deutsch English Español Polski
Low

Privilege Context Switching Error in Elasticsearch

  • Disclosed: 18.03.2021
  • Updated: 11.10.2026 12:20

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.elasticsearch:elasticsearch < 6.8.13, >= 7.0.0, < 7.9.2 6.8.13, 7.9.2

References

CVSS score 3.1/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE)
CWE-269, CWE-270
Platform
Java / Kotlin (Maven)
Package
org.elasticsearch:elasticsearch
Disclosed
18.03.2021
Updated
11.10.2026 12:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-g9fw-9x87-rmrj - CC BY 4.0

Vulnerability history: org.elasticsearch:elasticsearch

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (40) in the archive
Total entries
40
First → latest
03.2021 05.2025
Without a fix
0
Exploited in attacks
2

Severity breakdown

  • High 8
  • Medium 31
  • Low 1

Disclosures per year

Severity:
  1. Elasticsearch vulnerable to Uncontrolled Resource Consumption
    High · 7.5 CVE-2023-31418 < 7.17.13, >= 8.0.0, < 8.9.0 7.17.13, 8.9.0
  2. Improper Check for Unusual or Exceptional Conditions in Elasticsearch
    High · 7.5 CVE-2022-23712 >= 8.0.0, < 8.2.1 8.2.1
  3. Improper Privilege Management in Elasticsearch
    High · 8.8 CVE-2020-7009 >= 6.7.0, < 6.8.8, >= 7.0.0, < 7.6.2 6.8.8, 7.6.2
  4. Elasticsearch Improper Access Control vulnerability
    High · 8.1 Exploited in attacks CVE-2014-3120 < 1.4.0.Beta1 1.4.0.Beta1
  5. Improper Access Control in Elasticsearch
    High Exploited in attacks CVE-2015-1427 < 1.3.8, >= 1.4.0, < 1.4.3 1.3.8, 1.4.3
  6. Improper Access Control in Elasticsearch
    High · 7.5 CVE-2015-4165 < 1.6.0 1.6.0
  7. Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
    High · 8.8 CVE-2018-3831 >= 5.6.0, < 5.6.12, >= 6.0.0, < 6.4.1 5.6.12, 6.4.1
  8. Improper Access Control in Elasticsearch
    High · 8.1 CVE-2019-7611 < 5.6.15, >= 6.0.0, < 6.6.1 5.6.15, 6.6.1
  9. Privilege Context Switching Error in Elasticsearch this entry
    Low · 3.1 CVE-2020-7020 < 6.8.13, >= 7.0.0, < 7.9.2 6.8.13, 7.9.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.