CVE-2015-1427

Fixed upstream ExploitedEPSS 100%CVSS 9.8

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Published 2015-02-17 · In CISA KEV since 2022-03-25 · CVE record · OSV

Products: elasticsearch, redhat fuse

Fixed upstream

Ecosystem	Package	Fixed in
Maven	org.elasticsearch:elasticsearch	1.3.8
Maven	org.elasticsearch:elasticsearch	1.4.3