CVE-2015-1427
Critical · 9.8 CISA KEVCVSS
9.8
EPSS
99.9%
Published
Feb 17, 2015
CISA due date
Apr 15, 2022
The record
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.elasticsearch:elasticsearch | 0 | 1.3.8 |
| Maven | org.elasticsearch:elasticsearch | 1.4.0 | 1.4.3 |
| Ubuntu:16.04:LTS | elasticsearch | 0 | 1.7.3+dfsg-3 |
| maven | org.elasticsearch/elasticsearch | 1.4.0 | No fix |
Related vulnerabilities
- CVE-2025-37731 Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via… Also affects org.elasticsearch:elasticsearch
- CVE-2024-12539 Elasticsearch Incorrect Authorization vulnerability Also affects org.elasticsearch:elasticsearch
- CVE-2024-23444 It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is… Also affects org.elasticsearch:elasticsearch
- CVE-2023-49921 An issue was discovered by Elastic whereby Watcher search input logged the search query… Also affects org.elasticsearch:elasticsearch
- CVE-2024-37280 A flaw was discovered in Elasticsearch, affecting document ingestion when an index… Also affects org.elasticsearch:elasticsearch
- CVE-2024-23449 An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF… Also affects org.elasticsearch:elasticsearch
- CVE-2024-23451 Incorrect Authorization issue exists in the API key based security model for Remote… Also affects org.elasticsearch:elasticsearch
- CVE-2024-23450 A flaw was discovered in Elasticsearch, where processing a document in a deeply nested… Also affects org.elasticsearch:elasticsearch