CVE-2019-7614
Quick assessment
Affected
Elastic Elasticsearch
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Elasticsearch是一个基于Lucene库的搜索引擎。 Elasticsearch 7.2.1之前版本和6.8.2之前版本中存在竞争条件问题漏洞。攻击者可利用该漏洞获取含有其他用户敏感信息的响应头的访问权限。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-7614
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5
Vulnerability Title
Elasticsearch 竞争条件问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Elasticsearch是一个基于Lucene库的搜索引擎。 Elasticsearch 7.2.1之前版本和6.8.2之前版本中存在竞争条件问题漏洞。攻击者可利用该漏洞获取含有其他用户敏感信息的响应头的访问权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Elastic | Elasticsearch | before 7.2.1 and 6.8.2 | - |
|
II. Public POCs for CVE-2019-7614
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-7614
请登录查看更多情报信息。
Other References for CVE-2019-7614 (1)
-
https://www.elastic.co/community/security/ x_refsource_MISC
Same Patch Batch · Elastic · 2019-07-30 · 3 CVEs total
| CVE-2019-7615 | Elasticsearch Elastic APM agent for Ruby 信任管理问题漏洞 | |
| CVE-2019-7616 | Elasticsearch Kibana 代码问题漏洞 |
IV. Related Vulnerabilities
Same product: Elasticsearch
-
CVE-2026-72636
Uncontrolled Recursion in Elasticsearch Wildcard Matching Le -
CVE-2026-72642
Use of Out-of-range Pointer Offset in the Elasticsearch Mach -
CVE-2026-72639
Memory Allocation with Excessive Size Value in Elasticsearch -
CVE-2026-72638
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-72647
Uncontrolled Recursion in Elasticsearch Leading to Denial of
Same vendor: Elastic
-
CVE-2026-78581
Authorization Bypass Through User-Controlled Key in Kibana L -
CVE-2026-49096
Uncaught Exception in Kibana Cases Leading to Denial of Serv -
CVE-2026-72636
Uncontrolled Recursion in Elasticsearch Wildcard Matching Le -
CVE-2026-72632
Observable Discrepancy in Kibana Fleet Leading to Disclosure -
CVE-2026-72631
Improper Privilege Management in Kibana Fleet Leading to Ove
V. Comments for CVE-2019-7614
No comments yet