{"action":"Upgrade org.elasticsearch:elasticsearch to 1.4.0.Beta1 or later.","affected":[{"fixed":"1.4.0.Beta1","introduced":"0"}],"component":"org.elasticsearch:elasticsearch","cve_ids":["CVE-2014-3120"],"ecosystem":"Maven","epss":0.88559,"exploited":true,"fixed_versions":["1.4.0.Beta1"],"ghsa_id":"GHSA-mrfm-jxgf-2h6v","id":"tcs_01M5N95Q5B6AZ7AZ546DVW9FDY","modified_at":"2025-10-22T19:52:56.202431Z","published_at":"2022-05-17T03:28:58Z","references":["https://osv.dev/vulnerability/GHSA-mrfm-jxgf-2h6v","https://nvd.nist.gov/vuln/detail/CVE-2014-3120","https://github.com/elastic/elasticsearch/issues/7151","https://github.com/elastic/elasticsearch/pull/7642","https://github.com/elastic/elasticsearch/commit/bd0eb32d9c3c3f5b6e5f8630c859cd04bdcd4e06","https://github.com/elastic/elasticsearch/commit/f9de8b65898509e038e33215db0720b508477a12","https://github.com/elastic/elasticsearch","https://web.archive.org/web/20140813071419/http://www.securityfocus.com/bid/67731","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120","https://www.elastic.co/blog/logstash-1-4-3-released","https://www.elastic.co/community/security","https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch","http://bouk.co/blog/elasticsearch-rce","http://www.exploit-db.com/exploits/33370","http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-mrfm-jxgf-2h6v","url":"https://osv.dev/vulnerability/GHSA-mrfm-jxgf-2h6v"},{"source":"kev","source_id":"CVE-2014-3120","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Elasticsearch Improper Access Control vulnerability"}