CVE-2014-3120

Known Exploited Vulnerability

Elasticsearch Remote Code Execution Vulnerability

Vendor / product: Elastic / Elasticsearch

Description

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

Weakness classification

• nvd@nist.gov: CWE-284
• 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-284

Primary references

• cve@mitre.org — Exploit
• cve@mitre.org — Exploit
• cve@mitre.org — Broken Link
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Exploit
• cve@mitre.org — Vendor Advisory
• cve@mitre.org — Vendor Advisory
• cve@mitre.org — Exploit
• af854a3a-2127-422b-91ae-364da2661108 — Exploit
• af854a3a-2127-422b-91ae-364da2661108 — Exploit
• af854a3a-2127-422b-91ae-364da2661108 — Broken Link
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory