NVD

Id
31374  
Name
CVE-2014-3120  
Description
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor"s intended security policy if the user does not run Elasticsearch in its own independent virtual machine.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-07-28  
Modified Date
2016-12-06  
Seq
2014-3120  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
164248 31374 CVE-2014-3120 http://bouk.co/blog/elasticsearch-rce/  View
164249 31374 CVE-2014-3120 33370  View
164250 31374 CVE-2014-3120 http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce  View
164251 31374 CVE-2014-3120 67731  View
164252 31374 CVE-2014-3120 https://www.elastic.co/blog/logstash-1-4-3-released  View
164253 31374 CVE-2014-3120 https://www.elastic.co/community/security/  View
164254 31374 CVE-2014-3120 https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14734 JVNDB-2014-003609 Elasticsearch のデフォルト設定における任意の MVEL 式および Java コードをを実行される脆弱性 Elasticsearch のデフォルト設定は、動的スクリプトを有効にするため、任意の MVEL 式および Java コードを実行される脆弱性が存在します。 CVE-2014-3120 70407 CVE-2014-3120 31374 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003609.html 2014-05-22 2015-06-26 View