CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-7611 – elasticsearch: Improper permission issue when attaching a new name to an index
https://notcve.org/view.php?id=CVE-2019-7611
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index. Se ha encontrado un problema de permiso en versiones anteriores a las 5.6.15 y 6.6.1 de Elasticsearch cuando se encuentran deshabilitados Field Level Security y Document Level Security, y se utilizan los endpoints _aliases, _shrink o _split. Si el archivo elasticsearch.yml tiene la opción xpack.security.dls_fls.enabled configurada en ‘‘false’’, se omiten ciertas comprobaciones de permiso cuando los usuarios ejecutan una de las acciones mencionadas anteriormente, para hacer que los datos existentes sean disponibles bajo un nuevo alias o nombre de índice. • https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 https://www.elastic.co/community/security https://access.redhat.com/security/cve/CVE-2019-7611 https://bugzilla.redhat.com/show_bug.cgi?id=1696034 • CWE-284: Improper Access Control CWE-285: Improper Authorization •
CVSS: 5.0EPSS: 97%CPEs: 1EXPL: 3CVE-2015-5531 – ElasticSearch 1.6.0 - Arbitrary File Download
https://notcve.org/view.php?id=CVE-2015-5531
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. Vulnerabilidad de salto de directorio en Elasticsearch en versiones anteriores a 1.6.1, permite a atacantes remotos leer archivos arbitrarios a través de vectores no especificados relacionados con llamadas a la API de instantáneas. • https://www.exploit-db.com/exploits/38383 https://github.com/M0ge/CVE-2015-5531-POC https://github.com/xpgdgit/CVE-2015-5531 http://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html http://packetstormsecurity.com/files/133797/ElasticSearch-Path-Traversal-Arbitrary-File-Download.html http://packetstormsecurity.com/files/133964/ElasticSearch-Snapshot-API-Directory-Traversal.html http://www.securityfocus.com/archive/1/536017/100/0/threaded http://www.securityfocus.com/bid/75935 https:& • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 14%CPEs: 1EXPL: 1CVE-2015-5377
https://notcve.org/view.php?id=CVE-2015-5377
Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability ** EN DISPUTA ** Elasticsearch, en versiones anteriores a la 1.6.1, permite que atacantes remotos ejecuten código arbitrario mediante vectores sin especificar relacionados con el protocolo de transporte. NOTA: aparentemente, ZDI sostiene que CVE-2015-3253 y CVE-2015-5377 son la misma vulnerabilidad. • https://github.com/fi3ro/CVE-2015-5377 http://www.securityfocus.com/bid/75938 http://www.zerodayinitiative.com/advisories/ZDI-15-365 https://discuss.elastic.co/t/elasticsearch-remote-code-execution-cve-2015-5377/25736 https://github.com/elastic/elasticsearch/commit/bf3052d14c874aead7da8855c5fcadf5428a43f2 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 4.3EPSS: 96%CPEs: 3EXPL: 3CVE-2015-3337 – ElasticSearch < 1.4.5 / < 1.5.2 - Directory Traversal
https://notcve.org/view.php?id=CVE-2015-3337
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en Elasticsearch anterior a 1.4.5 y 1.5.x anterior a 1.5.2, cuando un plugin de sitio está habilitado, permite a atacantes remotos leer ficheros arbitrarios a través de vectores no especificados. • https://www.exploit-db.com/exploits/37054 https://github.com/jas502n/CVE-2015-3337 http://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html http://www.debian.org/security/2015/dsa-3241 http://www.securityfocus.com/archive/1/535385 http://www.securityfocus.com/bid/74353 https://www.elastic.co/community/security • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 97%CPEs: 5EXPL: 6CVE-2015-1427 – Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-1427
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script. El motor de secuencias de comandos Groovy en Elasticsearch anterior a 1.3.8 y 1.4.x anterior a 1.4.3 permite a atacantes remotos evadir el mecanismo de protección de sandbox y ejecutar comandos de shell arbitrarios a través de una secuencia de comandos manipulada. It was reported that Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM. The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands. • https://www.exploit-db.com/exploits/36415 https://www.exploit-db.com/exploits/36337 https://github.com/t0kx/exploit-CVE-2015-1427 https://github.com/xpgdgit/CVE-2015-1427 https://github.com/cyberharsh/Groovy-scripting-engine-CVE-2015-1427 http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html http://www.elasticsearch.com/blog/elasticsearch-1-4-3& • CWE-284: Improper Access Control •