CVE-2015-1427

Published: Feb 17, 2015Modified: Apr 22, 2026CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Affected (3)

Products: Elastic: Elasticsearch · Redhat: Fuse

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Elastic Elasticsearch	Before 1.3.8
Elastic Elasticsearch	From 1.4.0 to 1.4.3

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Fuse	Version 1.0.0

References (17)

http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/

Source: cve@mitre.org

PatchVendor Advisory

http://www.securityfocus.com/archive/1/534689/100/0/threaded

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/72585

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:0868

Source: cve@mitre.org

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/100850

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://www.elastic.co/community/security/

Source: cve@mitre.org

Not ApplicableVendor Advisory

http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html