Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cisa_kevCISACISA-KEV-CVE-2014-3120
HistoryMar 25, 2022 - 12:00 a.m.

Elasticsearch Remote Code Execution Vulnerability

2022-03-2500:00:00
CISA
www.cisa.gov
10
elasticsearch
remote code execution
vulnerability
dynamic scripting
mvel expressions
java code

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.495

Percentile

97.6%

JSON

Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.

Related

exploitpack 1
cve 1
packetstorm 2
veracode 2
exploitdb 2
redhat 3
zdt 2
cvelist 1
nvd 1
metasploit 1
freebsd 1
checkpoint_advisories 1
prion 1
nessus 3
attackerkb 1
nuclei 2
openvas 1
myhack58 1
threatpost 2
talosblog 1
exploitpack
exploitpack
ElasticSearch - Remote Code Execution
2014-05-15 00:00:00
cve
cve
CVE-2014-3120
2014-07-28 19:55:04
packetstorm
packetstorm
ElasticSearch Dynamic Script Arbitrary Java Execution
2014-05-30 00:00:00
Elastic Search 1.1.1 Arbitrary File Read
2014-07-30 00:00:00
veracode
veracode
Remote Code Execution (RCE)
2017-03-14 03:18:32
Remote Code Execution (RCE)
2019-01-15 09:01:00
exploitdb
exploitdb
ElasticSearch - Remote Code Execution
2014-05-15 00:00:00
ElasticSearch Dynamic Script - Arbitrary Java Execution (Metasploit)
2014-05-30 00:00:00
redhat
redhat
(RHSA-2014:1186) Important: katello-configure security update
2014-09-11 00:00:00
(RHSA-2014:1171) Important: Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
2014-09-10 00:00:00
(RHSA-2014:1170) Important: Red Hat JBoss Fuse/A-MQ 6.1.0 security update
2014-09-10 05:27:38
zdt
zdt
ElasticSearch Dynamic Script Arbitrary Java Execution
2014-06-01 00:00:00
ElasticSearch Remote Code Execution Exploit
2014-05-15 00:00:00
cvelist
cvelist
CVE-2014-3120
2014-07-28 19:00:00
nvd
nvd
CVE-2014-3120
2014-07-28 19:55:04
metasploit
metasploit
ElasticSearch Dynamic Script Arbitrary Java Execution
2014-05-27 23:01:16
freebsd
freebsd
elasticsearch and logstash -- remote OS command execution via dynamic scripting
2014-05-22 00:00:00
checkpoint_advisories
checkpoint_advisories
ElasticSearch search Remote Code Execution (CVE-2014-3120)
2014-05-25 00:00:00
prion
prion
Default configuration
2014-07-28 19:55:00
nessus
nessus
RHEL 6 : katello-configure (RHSA-2014:1186)
2014-09-12 00:00:00
Elasticsearch 'source' Parameter RCE
2014-07-17 00:00:00
FreeBSD : elasticsearch and logstash -- remote OS command execution via dynamic scripting (43ac9d42-1b9a-11e5-b43d-002590263bf5)
2015-06-26 00:00:00
attackerkb
attackerkb
CVE-2014-3120
2014-07-28 00:00:00
nuclei
nuclei
ElasticSearch v1.1.1/1.2 RCE
2021-02-15 13:35:15
Cisco Unified Communications Manager 7/8/9 - Directory Traversal
2021-07-22 23:12:07
openvas
openvas
Elastisearch RCE Vulnerability
2014-05-22 00:00:00
myhack58
myhack58
Crypto currency mining machine using Elasticsearch vulnerability propagation-vulnerability warning-the black bar safety net
2018-12-14 00:00:00
threatpost
threatpost
Windows, Linux Devices Hijacked In Two-Year Cryptojacking Campaign
2021-02-17 21:39:10
Golang Worm Widens Scope to Windows, Adds Payload Capacity
2020-06-25 18:30:59
talosblog
talosblog
Cisco Talos Honeypot Analysis Reveals Rise in Attacks on Elasticsearch Clusters
2019-02-26 10:56:00

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.495

Percentile

97.6%

JSON
Related for CISA-KEV-CVE-2014-3120
exploitpack1cve1packetstorm2veracode2exploitdb2redhat3zdt2cvelist1nvd1metasploit1freebsd1checkpoint_advisories1prion1nessus3attackerkb1nuclei2openvas1myhack581threatpost2talosblog1