Skip to content
Heist/ feed
Back to feed
Low

Security advisory

Type: advisorySources: OSVCVE: CVE-2020-7020

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2020-7020
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 04:57 UTC · Revision 1

Source evidence

CVE-2020-7020

core-osv · Original source

Published 22 Oct 2020, 17:15 UTC

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.

osv:CVE-2020-7020
Complete source record
{
  "id": "e0a47c42010e7602774b14b32954971a7e1e0be0e29292004a68f79d8a8295da",
  "url": "https://osv.dev/vulnerability/CVE-2020-7020",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2020-7020",
    "summary": "Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.",
    "evidence": "osv:CVE-2020-7020",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2020-7020",
      "aliases": [
        "BIT-elasticsearch-2020-7020",
        "CVE-2020-7020",
        "GHSA-g9fw-9x87-rmrj"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/elastic/elasticsearch",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "be13c699d0ab4706ec25626375b0965e3cdfa138"
                },
                {
                  "introduced": "b7e28a7232616c7a21bc879a535d801b8553ba77"
                },
                {
                  "fixed": "d34da0ea4a966c4e49417f2da2f244e3e97b4e6e"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "6.8.13"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "7.0.0"
                      },
                      {
                        "fixed": "7.9.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v7.9.1",
            "v6.8.12",
            "v7.9.0",
            "v6.8.11",
            "v6.8.10",
            "v6.8.9",
            "v6.8.8",
            "v6.8.7",
            "v6.8.6",
            "v6.8.5",
            "v6.8.4",
            "v6.8.3",
            "v6.8.2",
            "v6.8.1",
            "v6.8.0",
            "v6.7.2",
            "v6.7.1",
            "v6.7.0",
            "v7.0.0-alpha2",
            "v7.0.0-alpha1",
            "v6.0.0-alpha2",
            "v6.0.0-alpha1",
            "v1.0.0.RC1",
            "v1.0.0.Beta2",
            "v1.0.0.Beta1",
            "v0.90.0",
            "v0.90.0.RC2",
            "v0.90.0.RC1",
            "v0.90.0.Beta1",
            "v0.20.0.RC1",
            "v0.19.0",
            "v0.19.0.RC3",
            "v0.19.0.RC2",
            "v0.19.0.RC1",
            "v0.18.0",
            "v0.17.0",
            "v0.16.0",
            "v0.15.0",
            "v0.14.0",
            "v0.13.0",
            "v0.12.0",
            "v0.11.0",
            "v0.10.0",
            "v0.9.0",
            "v0.8.0",
            "v0.7.1",
            "v0.7.0",
            "v0.6.0",
            "v0.5.1",
            "v0.5.0",
            "v0.4.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7020.json"
          }
        }
      ],
      "modified": "2026-10-24T10:30:23.453268688Z",
      "provider": "osv",
      "references": [
        "https://discuss.elastic.co/t/elastic-stack-7-9-3-and-6-8-13-security-update/253033",
        "https://security.netapp.com/advisory/ntap-20201123-0001/",
        "https://staging-website.elastic.co/community/security/"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2020-7020",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 430924,
  "published_at": "2020-10-22T17:15:12.693+00:00"
}