Elastic App Search Cross Site Scripting flaw (ESA-2020-04)
Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be rendered by the web browser. If an attacker is able to control the contents of such a field, they could execute arbitrary JavaScript in the victim’s web browser.
Affected Versions
All versions before 7.7.0 are vulnerable to this issue.
Solutions and Mitigations
Users should upgrade to Elastic Enterprise Search version 7.7.0. There is no known workaround for this issue.
CVSSv3: 5.9 - AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CVE ID: CVE-2020-7011