CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2014-07-28
Elasticsearch < 1.2 Dynamic Scripting Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2014-3120)
[Affected Scope] Elasticsearch installations prior to version 1.2 running with default configurations
[Impact] Unauthenticated remote attackers can execute arbitrary MVEL expressions and Java code via the source parameter of the _search API, leading to complete system compromise
[Mitigation] Upgrade Elasticsearch to version 1.2 or higher, or explicitly disable dynamic scripting in the elasticsearch.yml configuration file