← CVE Radar
CVE-2014-3120Elasticsearch Remote Code Execution Vulnerability
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
8.1 HIGHEPSS 88.55%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.1 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| 6.8 | MEDIUM | 2.0NVD | AV:N/AC:M/Au:N/C:P/I:P/A:P |
CISA required action
⚡ Known exploited · remediation due Apr 15, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2014-3120
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Jul 28, 2014
- Last modified
- 2026-06-17 00:07 UTC
- Weaknesses
Affected Products
From NVD CPE configurations.
elasticelasticsearch1 version range
- before 1.2.0
References
- bouk.co http://bouk.co/blog/elasticsearch-rce/
- exploit-db.com http://www.exploit-db.com/exploits/33370
- osvdb.org http://www.osvdb.org/106949
- rapid7.com http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce
- securityfocus.com http://www.securityfocus.com/bid/67731
- elastic.co https://www.elastic.co/blog/logstash-1-4-3-released
- elastic.co https://www.elastic.co/community/security/
- found.no https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120