Risk | Low |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2021-22137 CVE-2021-22135 |
CWE-ID | CWE-281 CWE-264 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software |
IBM Security SOAR Server applications / IDS/IPS systems, Firewalls and proxy servers |
Vendor | IBM Corporation |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU51712
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-22137
CWE-ID:
CWE-281 - Improper preservation of permissions
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to search queries do not properly preserve security permissions when executing certain cross-cluster search queries. A remote user can disclose existence of documents via search functionality, when Document or Field Level Security is used.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Security SOAR: 29.0 - 41.2.35
CPE2.3https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-soar-is-using-a-version-of-elasticsearch-that-has-known-vulnerabilities-cve-2021-22137-cve-2021-22135/
https://www.ibm.com/support/pages/node/6493015
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU51710
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-22135
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. A remote user can perform certain queries to enable the profiler and suggester on index and disclose existence of documents and fields.
Install update from vendor's website.
Vulnerable software versionsIBM Security SOAR: 29.0 - 41.2.35
CPE2.3https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-soar-is-using-a-version-of-elasticsearch-that-has-known-vulnerabilities-cve-2021-22137-cve-2021-22135/
https://www.ibm.com/support/pages/node/6493015
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.