CVSS: 5.0EPSS: 97%CPEs: 1EXPL: 3CVE-2015-5531 – ElasticSearch 1.6.0 - Arbitrary File Download
https://notcve.org/view.php?id=CVE-2015-5531
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. Vulnerabilidad de salto de directorio en Elasticsearch en versiones anteriores a 1.6.1, permite a atacantes remotos leer archivos arbitrarios a través de vectores no especificados relacionados con llamadas a la API de instantáneas. • https://www.exploit-db.com/exploits/38383 https://github.com/M0ge/CVE-2015-5531-POC https://github.com/xpgdgit/CVE-2015-5531 http://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html http://packetstormsecurity.com/files/133797/ElasticSearch-Path-Traversal-Arbitrary-File-Download.html http://packetstormsecurity.com/files/133964/ElasticSearch-Snapshot-API-Directory-Traversal.html http://www.securityfocus.com/archive/1/536017/100/0/threaded http://www.securityfocus.com/bid/75935 https:& • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 14%CPEs: 1EXPL: 1CVE-2015-5377
https://notcve.org/view.php?id=CVE-2015-5377
Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability ** EN DISPUTA ** Elasticsearch, en versiones anteriores a la 1.6.1, permite que atacantes remotos ejecuten código arbitrario mediante vectores sin especificar relacionados con el protocolo de transporte. NOTA: aparentemente, ZDI sostiene que CVE-2015-3253 y CVE-2015-5377 son la misma vulnerabilidad. • https://github.com/fi3ro/CVE-2015-5377 http://www.securityfocus.com/bid/75938 http://www.zerodayinitiative.com/advisories/ZDI-15-365 https://discuss.elastic.co/t/elasticsearch-remote-code-execution-cve-2015-5377/25736 https://github.com/elastic/elasticsearch/commit/bf3052d14c874aead7da8855c5fcadf5428a43f2 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2015-4165
https://notcve.org/view.php?id=CVE-2015-4165
The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execute arbitrary code. La API snapshot en Elasticsearch en versiones anteriores a la 1.6.0, cuando otra aplicación existe en el sistema que puede leer archivos Lucene y ejecutar código desde los mismos, se vuelve accesible para el atacante. Además, la máquina virtual Java VM desde la que se está ejecutando Elasticsearch puede escribir en una localización desde la que la otra aplicación puede leer y ejecutar. Esto permite que usuarios remotos autenticados escriban y creen archivos de metadatos snapshot arbitrarios y, potencialmente, ejecuten código arbitrario. • http://packetstormsecurity.com/files/132234/Elasticsearch-1.5.2-File-Creation.html http://www.securityfocus.com/archive/1/535727/100/0/threaded http://www.securityfocus.com/archive/1/536855/100/0/threaded http://www.securityfocus.com/bid/75113 https://bugzilla.redhat.com/show_bug.cgi?id=1230761 https://www.elastic.co/community/security • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 96%CPEs: 3EXPL: 3CVE-2015-3337 – ElasticSearch < 1.4.5 / < 1.5.2 - Directory Traversal
https://notcve.org/view.php?id=CVE-2015-3337
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en Elasticsearch anterior a 1.4.5 y 1.5.x anterior a 1.5.2, cuando un plugin de sitio está habilitado, permite a atacantes remotos leer ficheros arbitrarios a través de vectores no especificados. • https://www.exploit-db.com/exploits/37054 https://github.com/jas502n/CVE-2015-3337 http://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html http://www.debian.org/security/2015/dsa-3241 http://www.securityfocus.com/archive/1/535385 http://www.securityfocus.com/bid/74353 https://www.elastic.co/community/security • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 97%CPEs: 5EXPL: 6CVE-2015-1427 – Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-1427
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script. El motor de secuencias de comandos Groovy en Elasticsearch anterior a 1.3.8 y 1.4.x anterior a 1.4.3 permite a atacantes remotos evadir el mecanismo de protección de sandbox y ejecutar comandos de shell arbitrarios a través de una secuencia de comandos manipulada. It was reported that Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM. The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands. • https://www.exploit-db.com/exploits/36415 https://www.exploit-db.com/exploits/36337 https://github.com/t0kx/exploit-CVE-2015-1427 https://github.com/xpgdgit/CVE-2015-1427 https://github.com/cyberharsh/Groovy-scripting-engine-CVE-2015-1427 http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html http://www.elasticsearch.com/blog/elasticsearch-1-4-3& • CWE-284: Improper Access Control •