GitHub Advisoryadvisory · Maven
GHSA-w94p-6mhw-4qxw Improper Access Control in Elasticsearch
HIGH
Official page ↗
- Aliases
- CVE-2015-1427
- Ecosystem
- Maven
- Packages
- org.elasticsearch:elasticsearch
- Severity
- High
- Weaknesses
- CWE-284
- Reviewed
- 2022-07-06
Affected packages
• Maven org.elasticsearch:elasticsearch: < 1.3.8 → fixed in 1.3.8
• Maven org.elasticsearch:elasticsearch: >= 1.4.0, < 1.4.3 → fixed in 1.4.3
Description
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Related
Alias · CVE (1)
- CVE-2015-1427 The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection… vulnerability
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-1427 advisory
- https://access.redhat.com/errata/RHSA-2017:0868 web
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100850 web
- https://www.elastic.co/community/security web
- http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html web
- http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html web
- http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released web