CVE-2014-3120highunder attackCWE-284

CVE-2014-3120

Published · Updated

Follow this CVE+ Monitor Elasticsearch+ Monitor org.elasticsearch:elasticsearch

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.1epss 89%
from disclosure to weaponsame day
Published on NVDJul 28
1st PoCMay 13
metasploitDec 9
CISA KEV+2797d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
6 products (7 components)
Red Hat Subscription Asset Manager for RHEL 6 Server · Fuse ESB Enterprise 7.1.0 · Fuse MQ Enterprise 7.1.0 · Fuse Management Console 7.1.0 · Red Hat JBoss A-MQ 6.1 · and others 1
fix ↗
Not affected
1 product — because the vulnerable code is not present in the product
Red Hat Satellite 6
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

Elasticsearch before version 1.2 allows attackers to run arbitrary code on the server through search requests because dynamic scripting is enabled by default. This is a serious vulnerability if Elasticsearch is not isolated on its own machine.

Technical detail

CVE-2014-3120 exploits enabled dynamic scripting in Elasticsearch <1.2, allowing unauthenticated remote code execution via MVEL expressions in the _search API's source parameter. Exploitation requires network access to the Elasticsearch service; impact includes complete system compromise. The vulnerability assumes Elasticsearch runs in a shared environment without proper isolation.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.