Skip to content
Sign in

Bug bounty reports15,219

Atlas

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Program:Elastic
Status:Valid
Clear
Severity
Weakness
Year
Bounty paid2
Access stated
  • No account0
  • A user account0
  • Admin or privileged0
Access needed
  • No account1
  • A user account0
  • A privileged role0
  • Admin0
  • Physical or local access0
  • Not clear from the report0
Technique
Clear filters14 of 15,219 reports
Disclosed bug bounty reports
ReportStatusWeaknessSeverityDisclosedBountyVotes
[Swiftype] - Stored XSS via document field `url` triggers on `https://app.swiftype.com/engines/<engine>/document_types/<type>/documents/<id>`#1245787ValidCross-site ScriptingHigh2021-08-03–7
XXE in Enterprise Search's App Search web crawler#1156748ValidInjection and Smuggling–2021-04-29–9
Fix for CVE-2021-22151 (Kibana path traversal issue) can be bypassed on Windows#1353603ValidFile and Path HandlingLow2021-11-15–10
Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges#1168528ValidAccess Control–2021-06-02–13
Default password on 34.120.209.175#1415241ValidAuthenticationMedium2022-11-18–13
Remote Code Execution in coming Kibana 7.7.0#861744ValidAccess Control–2021-04-19$5,00014
Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine Access#1218680ValidAccess ControlHigh2021-08-03–21
RCE hazard in reporting (via Chromium)#1168765ValidAccess Control–2021-05-26$10,00025
CSRF in AppSearch allows creation of "curations"#1477050ValidCross-Site Request ForgeryMedium2022-11-17–35
Synthetics Recorder: Code injection when recording website with malicious content#1636382ValidCommand and Code InjectionHigh2023-04-08–47
blind Server-Side Request Forgery (SSRF) allows scanning internal ports#1300585ValidServer-Side Request ForgeryMedium2023-05-05–54
Critical || Unrestricted access to private Github repos and properties of Elastic through leaked token of Elastic employee#1266188ValidCryptographyCritical2021-09-01–64
CVE-2021-40870 on [52.204.160.31]#1356845ValidCommand and Code InjectionCritical2021-10-06–75
Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)Analysed#998398ValidCross-site Scripting–2021-08-16–157

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in