VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jun 3, 2020· Updated Jun 17, 2026

CVE-2020-7011

CVE-2020-7011

Description

Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. If the Reference UI injects a URL into a result, that URL will be rendered by the web browser. If an attacker is able to control the contents of such a field, they could execute arbitrary JavaScript in the victim�s web browser.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Elastic/App Search2 versions
    cpe:2.3:a:elastic:elastic_app_search:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:elastic:elastic_app_search:*:*:*:*:*:*:*:*range: <7.7.0
    • (no CPE)range: <7.7.0
  • Elastic/Elasticsearchcpe-rescue
    Range: before 7.7.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.