Skip to content
OpenAdvisories
Unscored CVE-2021-37940 EUVD-2021-24415GHSA-xj2x-h5m7-w8gv

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterpr…

Published Dec 7, 2021 · Updated Aug 4, 2024 · Assigned by elastic

Description

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integration. Using this vulnerability, a malicious Workplace Search admin could use the GHES integration to view hosts that might not be publicly accessible.

Affected products

VendorProductAffectedFixed
Elastic Enterprisesearch before 7.16.0 —

References