CVE-2014-3120
7.2 High
AI Score
Confidence
Low
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.532 Medium
EPSS
Percentile
97.6%
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor’s intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
| CPE | Name | Operator | Version |
|---|---|---|---|
| elasticsearch:elasticsearch | elasticsearch | le | 1.1.1 |
References
bouk.co/blog/elasticsearch-rce/
www.exploit-db.com/exploits/33370
www.osvdb.org/106949
www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce
www.securityfocus.com/bid/67731
www.elastic.co/blog/logstash-1-4-3-released
www.elastic.co/community/security/
www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch
Social References
More
Related
7.2 High
AI Score
Confidence
Low
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.532 Medium
EPSS
Percentile
97.6%