CVE-2015-3337

2015-05-0115:59:06

CWE-22

[email protected]

web.nvd.nist.gov

cve-2015-3337

directory traversal

elasticsearch

vulnerability

remote attack

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

8.9 High

AI Score

Confidence

High

0.962 High

EPSS

Percentile

99.5%

JSON

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.

Affected configurations

NVD

Node

elasticsearchelasticsearchRange≤1.4.4

elasticsearchelasticsearchMatch1.5.0

elasticsearchelasticsearchMatch1.5.1

CPENameOperatorVersion
elasticsearch:elasticsearchelasticsearchle1.4.4
elasticsearch:elasticsearchelasticsearcheq1.5.0
elasticsearch:elasticsearchelasticsearcheq1.5.1