ElasticsearchGHSA-mrfm-jxgf-2h6v
Elasticsearch Improper Access Control vulnerability
High8.1CVE-2014-3120 · Published May 17, 2022 · updated Oct 22, 2025
The default configuration in Elasticsearch before 1.4.0.Beta1 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.elasticsearch:elasticsearch Maven | < 1.4.0.Beta1 | 1.4.0.Beta1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-284
- Also known as
- CVE-2014-3120
- nvd.nist.gov/vuln/detail/CVE-2014-3120
- github.com/elastic/elasticsearch/issues/7151
- github.com/elastic/elasticsearch/pull/7642
- github.com/elastic/elasticsearch/commit/bd0eb32d9c3c3f5b6e5f8630c859cd04bdcd4e06
- github.com/elastic/elasticsearch/commit/f9de8b65898509e038e33215db0720b508477a12
- github.com/elastic/elasticsearch
- web.archive.org/web/20140813071419/http://www.securityfocus.com/bid/67731
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120
- www.elastic.co/blog/logstash-1-4-3-released
- www.elastic.co/community/security
- www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch
- bouk.co/blog/elasticsearch-rce
- www.exploit-db.com/exploits/33370
- www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce
More Elasticsearch advisories
All Elasticsearch| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 172022 | Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch MediumMay 17, 2022 | Medium | 1.4.5+1 more |
| May 142022 | Cross-site scripting in ElasticsearchMediumMay 14, 2022 | Medium | 1.4.0.Beta1 |
| May 142022 | Improper Access Control in ElasticsearchHighMay 14, 2022 | High | 1.3.8+1 more |
| May 142022 | Improper Access Control in ElasticsearchHigh7.5May 14, 2022 | High7.5 | 1.6.0 |
| May 142022 | Improper Limitation of a Pathname to a Restricted Directory in ElasticsearchMediumMay 14, 2022 | Medium | 1.6.1 |
| May 132022 | Improper Restriction of XML External Entity Reference in ElasticsearchMedium5.9May 13, 2022 | Medium5.9 | 6.5.2 |