CVE-2014-3120

8.1

HIGHCVSS v3

Published

July 28, 2014

CVSS v2

6.8 MEDIUM

Affected

6 projects

Assigned by

MITRE

Severity scale

010

Description

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

elastic/elasticsearch

GitHubFree and Open Source, Distributed, RESTful Search Engine

= *, < 1.2.0NVD

elasticsearch

NPMThe official low-level Elasticsearch client for Node.js and the browser.

= *, < 1.2.0NVD

Elasticsearch

Chocolatey

More on this CVE

NVD↗GitHub Advisory↗

## The heart of the free and open Elastic Stack Elasticsearch is a distributed, RESTful search and analytics engine capable of addressing a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data for lightning fast search, fine‑tuned relevancy, and powerful analytics that scale with ease. **Please Note**: This is an automatically updated package. If you find it is out of date by more than a day or two, please contact the maintainer(s) and let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.

= *, < 1.2.0NVD

elasticsearch

Python Package IndexPython client for Elasticsearch

= *, < 1.2.0NVD

elasticsearch

RubyGemsRuby integrations for Elasticsearch (client, API, etc.)

= *, < 1.2.0NVD

elasticsearch/elasticsearch

PackagistPHP Client for Elasticsearch

= *, < 1.2.0NVD

Security Advisories

CVE-2014-3120

Description

More on this CVE