CRITICAL🇵🇱 Wersja polska

CVE-2015-5377

CVSS 9.8v3.0pub. 2018-03-06upd. 2024-11-21

Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Elastic Elasticsearch

    APP
    Elastic
    < 1.6.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2015-1427CRITICAL9.8⚠ KEVten sam produkt

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to by...

CVE-2014-3120HIGH8.1⚠ KEVten sam produkt

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers...

CVE-2023-31418HIGH7.5ten sam produkt

An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenti...

CVE-2022-23712HIGH7.5ten sam produkt

A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacke...

CVE-2021-22146HIGH7.5ten sam produkt

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed...