AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

ElasticsearchGHSA-8699-m855-cwqf

Cross-site scripting in Elasticsearch

Elasticsearch

CVE-2014-6439 · Published May 14, 2022 · updated Dec 4, 2024

Medium
Fix: upgrade to 1.4.0.Beta1 or later
GitHub advisory

Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected versions

PackageAffectedFixed in
org.elasticsearch:elasticsearch
Maven
< 1.4.0.Beta11.4.0.Beta1
Details and references
Severity from
GitHub (reviewed advisory)
Weakness
CWE-79
Also known as
CVE-2014-6439

More Elasticsearch advisories

All Elasticsearch
HighMay 14, 2022Improper Access Control in ElasticsearchCVE-2015-1427fixed in 1.3.8 +1High 7.5May 14, 2022Improper Access Control in ElasticsearchCVE-2015-4165fixed in 1.6.0MediumMay 14, 2022Improper Limitation of a Pathname to a Restricted Directory in ElasticsearchCVE-2015-5531fixed in 1.6.1Medium 5.9May 13, 2022Improper Restriction of XML External Entity Reference in ElasticsearchCVE-2018-17247fixed in 6.5.2Medium 6.5May 13, 2022Exposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2018-17244fixed in 6.4.3Medium 6.1May 13, 2022Elasticsearch subject to cross site scriptingCVE-2018-3824fixed in 5.6.9 +1