# How to fix vulnerability(CVE-2001-1199)

**URL:** <https://discuss.elastic.co/t/how-to-fix-vulnerability-cve-2001-1199/312441>\
**Category:** Elasticsearch\
**Created:** [August 19, 2022, 8:08am UTC](https://discuss.elastic.co/t/how-to-fix-vulnerability-cve-2001-1199/312441 "2022-08-19T08:08:57Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![wilsonyy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wilsonyy/32/109864_2.png) [@wilsonyy](https://discuss.elastic.co/u/wilsonyy)\
**Post date:** [August 19, 2022, 8:08am UTC](https://discuss.elastic.co/t/how-to-fix-vulnerability-cve-2001-1199/312441/1 "2022-08-19T08:08:57Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/7/6/76a2d1f60ef395800a1c6e2a5cedd143ec6e90a4.png)

A cross-site scripting vulnerability（ [CVE-2001-1199](https://www.cvedetails.com/cve/CVE-2001-1199/)） was found in Elasticsearch:9200，I've never seen it before，so how to fix it, anybody helps?

---

<div class="post-metadata">

**Author:** ![wilsonyy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wilsonyy/32/109864_2.png) [@wilsonyy](https://discuss.elastic.co/u/wilsonyy)\
**Post date:** [August 19, 2022, 8:49am UTC](https://discuss.elastic.co/t/how-to-fix-vulnerability-cve-2001-1199/312441/2 "2022-08-19T08:49:40Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/2/3/236bd7b51bd5167d818a758b38b497d53387b456.png)  
full report like that，Elasticsearch Version: 7.9.0

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [August 19, 2022, 9:20am UTC](https://discuss.elastic.co/t/how-to-fix-vulnerability-cve-2001-1199/312441/3 "2022-08-19T09:20:27Z")

</div>

What about upgrading your elasticsearch version? That's the way to go.

---

<div class="post-metadata">

**Author:** ![cheshirecat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cheshirecat/32/109532_2.png) [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\
**Post date:** [August 19, 2022, 9:34am UTC](https://discuss.elastic.co/t/how-to-fix-vulnerability-cve-2001-1199/312441/4 "2022-08-19T09:34:02Z")

</div>

First of all questions: why do you use default port?

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [August 19, 2022, 10:39am UTC](https://discuss.elastic.co/t/how-to-fix-vulnerability-cve-2001-1199/312441/5 "2022-08-19T10:39:36Z")

</div>

CVE-2001-1199 is a vulnerability in a system called Agora which is unrelated to Elasticsearch. Are you using Agora? If so, you need help from someone with Agora expertise. If not, your vulnerability scanner is buggy. Either way, I don't think this is the best place to get help.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 22, 2022, 12:26am UTC](https://discuss.elastic.co/t/how-to-fix-vulnerability-cve-2001-1199/312441/6 "2022-08-22T00:26:50Z")

</div>

FYI 7.9 is [EOL](https://www.elastic.co/support/eol) and no longer supported, you need to upgrade as a matter of urgency.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2022, 12:27am UTC](https://discuss.elastic.co/t/how-to-fix-vulnerability-cve-2001-1199/312441/7 "2022-09-19T00:27:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.