Elasticsearch

Records19All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

Elasticsearch records in CISA KEV

No Elasticsearch vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Packetbeat 6 records LOW Elasticsearch 4 records HIGH Kibana 3 records LOW Logstash 3 records LOW Cloud Enterprise 1 record LOW Output Plugin 1 record LOW X-pack 1 record LOW X-pack Reporting 1 record LOW

Records

4 records in Elasticsearch · all components

TI-2015-04656 CVE-2015-5531 · GHSA-jjq8-vfjq-j6v4

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers…

HIGH 67

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.94788 Published 2015-08-17 Fixed in 1.6.1 CWE-22

TI-2015-02950 CVE-2015-3337 · GHSA-x8q8-4hp5-463w

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2…

MEDIUM 45

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.3316 Published 2015-05-01 Partial fix · 1.4.5, 1.5.2 CWE-22

TI-2015-03491 CVE-2015-4165 · GHSA-fh5x-4j57-6q5x

The snapshot API in Elasticsearch before 1.6.0 when another application exists on the…

MEDIUM 40

The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is…

CVSS 3.0HIGH 7.5 Network Low privileges No interaction EPSS 0.0445 Published 2017-08-09 Partial fix · 1.6.0 CWE-264

TI-2014-05292 CVE-2014-6439 · GHSA-8699-m855-cwqf

Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch…

LOW 24

Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02023 Published 2014-10-10 Partial fix · 1.4.0.Beta1 CWE-79

Open these records in search →

Critical	0
High	5
Medium	14
Low	0
No CVSS	0