{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2021-22140 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2021-22140 yet. Limit exposure of the affected software until one is available.","what":"CVE-2021-22140 is a high-severity vulnerability in Elastic App Search, published on 13 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-22140 and fix it if it is affected.\n\nWhat it is: CVE-2021-22140 is a high-severity vulnerability in Elastic App Search, published on 13 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2021-22140 in the wild and no public exploit code.\n\nAffected product: Elastic App Search. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-22140/ (Markdown: https://insights.sbomify.com/CVE-2021-22140/index.md)","id":"CVE-2021-22140","markdown":"https://insights.sbomify.com/CVE-2021-22140/index.md","name":"CVE-2021-22140","record":{"aliases":["GHSA-6j6p-6hm2-m4qc"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"Elastic App Search","requires_auth":"none","summary":"An attacker can exploit an XML External Entity vulnerability in the beta web crawler to read sensitive files from the host filesystem.","user_interaction":"not_required","vuln_class":"xxe"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"elastic","cpe":[{"product":"elastic_app_search","vendor":"elastic"}],"cvss":{"score":7.5,"severity":"high","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"description":"Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could craft a malicious sitemap.xml to traverse the filesystem of the host running the instance and obtain sensitive files.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"XML external entity in Elastic App Search","id":"CVE-2021-22140","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"xxe","year":"2021"},"n_packages":0,"n_references":1,"next":{"headline":"Open redirect in Kibana","id":"CVE-2021-22141"},"packages":[],"prev":{"headline":"Denial of service in Kibana","id":"CVE-2021-22139"},"products":["Elastic App Search"],"published":"2021-05-13","related":[{"cvss_score":6.1,"headline":"Cross-site scripting in Elastic App Search","id":"CVE-2020-7011","kev_date_added":null,"published":"2020-06-03"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-03","vendors":["Elastic"]},"summary":"An attacker can exploit an XML External Entity vulnerability in the beta web crawler to read sensitive files from the host filesystem.","url":"https://insights.sbomify.com/CVE-2021-22140/"}