CVE-2014-3120
KEV
🔴 Łataj teraz
Domyślna konfiguracja Elasticsearch umożliwia zdalne wykonanie kodu przez dynamiczne skrypty.
CVSS
8.1
EPSS
82.6%
Exploit
weaponized
Vendor
elastic
Opis źródłowy (NVD)
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 8.1 |
| CISA KEV (aktywnie wykorzystywane) | Tak |
| FIRST EPSS (prawdopodobieństwo exploita) | 82.6% |
| Opublikowano (NVD) | 2014-07-28 19:55:04 UTC |
| Ostatnia modyfikacja (NVD) | 2026-04-22 14:33:20 UTC |
Referencje
- http://bouk.co/blog/elasticsearch-rce/ (cve@mitre.org) [Exploit]
- http://www.exploit-db.com/exploits/33370 (cve@mitre.org) [Exploit]
- http://www.osvdb.org/106949 (cve@mitre.org) [Broken Link]
- http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce (cve@mitre.org) [Exploit, Third Party Advisory]
- http://www.securityfocus.com/bid/67731 (cve@mitre.org) [Exploit]
- https://www.elastic.co/blog/logstash-1-4-3-released (cve@mitre.org) [Vendor Advisory]
- https://www.elastic.co/community/security/ (cve@mitre.org) [Vendor Advisory]
- https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch (cve@mitre.org) [Exploit]
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120 (134c704f-9b21-4f2e-91b3-4a467353bcc0) [US Government Resource]