HIGH🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2014-3120

CVSS 8.1v3.1pub. 2014-07-28upd. 2026-04-22

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

  • Elastic Elasticsearch

    APP
    Elastic
    < 1.2.0

CISA KEV — detailsi

Vendori
Elastic
Producti
Elasticsearch
Added to KEVi
March 25, 2022
Remediation deadline (US Federal)i
April 15, 2022(overdue)
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 15 kwietnia 2022
CWE
References

Related vulnerabilities

CVE-2015-1427CRITICAL9.8⚠ KEVPL ✓same product

Elasticsearch: ucieczka z sandboksa Groovy i zdalne wykonanie poleceń

CVE-2015-5377CRITICAL9.8PL ✓same product

RCE w Elasticsearch przez protokół transportowy (przed wersją 1.6.1)

CVE-2026-72649HIGH8.8same product

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote...

CVE-2026-72642HIGH8.8same product

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a mo...

CVE-2023-31418HIGH7.5same product

An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenti...