CVE-2015-1427
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Elasticsearch allowed attackers to run any command on the server by bypassing safety restrictions in its Groovy script feature. This is critical because it gives complete control of the affected system to anyone who can send a malicious script.
The Groovy scripting engine in vulnerable Elasticsearch versions (before 1.3.8 and 1.4.x before 1.4.3) failed to properly enforce sandbox restrictions, allowing remote code execution. An attacker could craft malicious Groovy scripts to escape the sandbox and execute arbitrary shell commands with the privileges of the Elasticsearch process, leading to full system compromise.
The full analysis of this CVE is available in Portuguese →