CVE

Id
70415  
CVE No.
CVE-2014-3120  
Status
Candidate  
Description
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor"s intended security policy if the user does not run Elasticsearch in its own independent virtual machine.  
Phase
Assigned (20140429)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
669842 70415 CVE-2014-3120 EXPLOIT-DB:33370  View
669843 70415 CVE-2014-3120 URL:http://www.exploit-db.com/exploits/33370  View
669844 70415 CVE-2014-3120 MISC:http://bouk.co/blog/elasticsearch-rce/  View
669845 70415 CVE-2014-3120 MISC:http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce  View
669846 70415 CVE-2014-3120 MISC:https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch  View
669847 70415 CVE-2014-3120 CONFIRM:https://www.elastic.co/blog/logstash-1-4-3-released  View
669848 70415 CVE-2014-3120 CONFIRM:https://www.elastic.co/community/security/  View
669849 70415 CVE-2014-3120 BID:67731  View
669850 70415 CVE-2014-3120 URL:http://www.securityfocus.com/bid/67731  View
669851 70415 CVE-2014-3120 OSVDB:106949  View

Related JVN