CVE-2015-1427

KEV

Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability

View CVE record →

Vendor / Project: Elastic
Product: Elasticsearch
Date added: Mar 25, 2022
Due date: Apr 15, 2022
Known ransomware use: Unknown
CWEs: CWE-284

Description

The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2015-1427