AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ElasticsearchGHSA-x8q8-4hp5-463w

Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch

Elasticsearch

CVE-2015-3337 · Published May 17, 2022 · updated Dec 7, 2024

Medium
Fix: upgrade to 1.4.5 or later (2 fixed versions below)
GitHub advisory

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.

Affected versions

PackageAffectedFixed in
org.elasticsearch:elasticsearch
Maven
< 1.4.51.4.5
>= 1.5.0, < 1.5.21.5.2
Details and references
Severity from
GitHub (reviewed advisory)
Weakness
CWE-22
Also known as
CVE-2015-3337

More Elasticsearch advisories

All Elasticsearch
High 8.1May 17, 2022Elasticsearch Improper Access Control vulnerabilityCVE-2014-3120fixed in 1.4.0.Beta1MediumMay 14, 2022Cross-site scripting in ElasticsearchCVE-2014-6439fixed in 1.4.0.Beta1HighMay 14, 2022Improper Access Control in ElasticsearchCVE-2015-1427fixed in 1.3.8 +1High 7.5May 14, 2022Improper Access Control in ElasticsearchCVE-2015-4165fixed in 1.6.0MediumMay 14, 2022Improper Limitation of a Pathname to a Restricted Directory in ElasticsearchCVE-2015-5531fixed in 1.6.1Medium 5.9May 13, 2022Improper Restriction of XML External Entity Reference in ElasticsearchCVE-2018-17247fixed in 6.5.2