PT-2014-5099

Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 1.2 Description The default configuration in Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to the search...