GitHub Advisoryadvisory · Maven

GHSA-mrfm-jxgf-2h6v Elasticsearch Improper Access Control vulnerability

HIGH Published 2022-05-17 Modified 2025-10-22 Official page ↗
Aliases
CVE-2014-3120
Ecosystem
Maven
Packages
org.elasticsearch:elasticsearch
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:H
Weaknesses
CWE-284
Reviewed
2025-01-06

Affected packages

• Maven org.elasticsearch:elasticsearch: < 1.4.0.Beta1 → fixed in 1.4.0.Beta1

Description

The default configuration in Elasticsearch before 1.4.0.Beta1 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

Related

Alias · CVE (1)

  • CVE-2014-3120 The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References