Maven/org.elasticsearch:elasticsearch CVE-2015-1427: high, exploited, EPSS 99.91%
Improper Access Control in Elasticsearch
Action: Upgrade org.elasticsearch:elasticsearch to 1.3.8 (1.3.x) or 1.4.3 (1.4.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.3.8 | - |
| 1.4.0 | 1.4.3 | - |
Fixed versions
| 1.3.8 | 1.4.3 |
Sources
- osv: GHSA-w94p-6mhw-4qxw
- kev: CVE-2015-1427
- https://nvd.nist.gov/vuln/detail/CVE-2015-1427
- https://access.redhat.com/errata/RHSA-2017:0868
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100850
- https://www.elastic.co/community/security
- http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html
- http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html
- http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released
CVE-2015-1427 · published · modified · JSON