← CVE Radar
CVE-2015-1427Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
9.8 CRITICALEPSS 99.90%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 7.5 | HIGH | 2.0NVD | AV:N/AC:L/Au:N/C:P/I:P/A:P |
CISA required action
⚡ Known exploited · remediation due Apr 15, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2015-1427
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Feb 17, 2015
- Last modified
- 2026-06-17 00:22 UTC
- Weaknesses
Affected Products
From NVD CPE configurations.
elasticelasticsearch2 version ranges
- before 1.3.8
- 1.4.0 before 1.4.3
redhatfuse1 version range
- 1.0.0
References
- packetstormsecurity.com http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html
- packetstormsecurity.com http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html
- elasticsearch.com http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/
- securityfocus.com http://www.securityfocus.com/archive/1/534689/100/0/threaded
- securityfocus.com http://www.securityfocus.com/bid/72585
- access.redhat.com https://access.redhat.com/errata/RHSA-2017:0868
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/100850
- elastic.co https://www.elastic.co/community/security/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1427