Elasticsearch < 1.6.1 Multiple Vulnerabilities - Linux

Elasticsearch is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elastic:elasticsearch";...

CVE-2015-5531

Elasticsearch versions 1.0.0 through 1.6.0 are vulnerable to a directory traversal attack (CVE-2015-5531) due to insufficient validation of user-supplied paths during snapshot API calls. A remote, unauthenticated attacker can exploit this by sending crafted packets using traversal characters (e.g...

CVE-2015-5531

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls...