The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which…
Priority CRITICAL 92Exploited in the wildCWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.
Summary
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Why it matters now
Exploitation Active In CISA KEV since 2022-03-25CISA due date 2022-04-15
EPSS 0.88559 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA and NVD
Fix Fixed org.elasticsearch:elasticsearch (Maven): 1.4.0.Beta1Red Hat: 3 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.elasticsearch:elasticsearch (Maven) | before 1.4.0.Beta1 | 1.4.0.Beta1 | Patch available | GHSA-mrfm-jxgf-2h6v |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.elasticsearch:elasticsearch (Maven) Vendor— Affected before 1.4.0.Beta1 Fixed in 1.4.0.Beta1 Patch available GHSA-mrfm-jxgf-2h6v
Remediation
- Fix · GHSA-mrfm-jxgf-2h6v org.elasticsearch:elasticsearch (Maven) Fixed in 1.4.0.Beta1 Advisory →
Red Hat 3 advisories
- RHSA-2014:1186 Released 2014-09-11 · Red Hat rating Importantkatello-configure security update
- Red Hat Subscription Asset Manager for RHEL 6 Server katello-configure-1.4.5.1-3.el6sam
- RHSA-2014:1171 Released 2014-09-10 · Red Hat rating ImportantFuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
- Fuse ESB Enterprise 7.1.0
- Fuse MQ Enterprise 7.1.0
- Fuse Management Console 7.1.0
- RHSA-2014:1170 Released 2014-09-10 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.1.0 security update
- Red Hat JBoss A-MQ 6.1
- Red Hat JBoss Fuse 6.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Fuse ESB Enterprise 7.1.0 | Fixed | RHSA-2014:1171 |
| Fuse MQ Enterprise 7.1.0 | Fixed | RHSA-2014:1171 |
| Fuse Management Console 7.1.0 | Fixed | RHSA-2014:1171 |
| Red Hat JBoss A-MQ 6.1 | Fixed | RHSA-2014:1170 |
| Red Hat JBoss Fuse 6.1 | Fixed | RHSA-2014:1170 |
| Red Hat Subscription Asset Manager for RHEL 6 Server | Fixed | RHSA-2014:1186 |
Not affected: 1 product
- Red Hat Satellite 6
Timeline
- 2022-03-25 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2014-3120
- 2026-10-03 Alias added: GHSA-mrfm-jxgf-2h6v
References
Exploit 3
Advisory 3
Other 10
- 106949
- https://github.com/elastic/elasticsearch/issues/7151
- https://github.com/elastic/elasticsearch/pull/7642
- https://github.com/elastic/elasticsearch/commit/bd0eb32d9c3c3f5b6e5f8630c859cd04bdcd4e06
- https://github.com/elastic/elasticsearch/commit/f9de8b65898509e038e33215db0720b508477a12
- https://github.com/elastic/elasticsearch
- https://web.archive.org/web/20140813071419/http://www.securityfocus.com/bid/67731
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120
- https://www.elastic.co/community/security
- http://bouk.co/blog/elasticsearch-rce
More Elasticsearch vulnerabilities
- TI-2015-01295 The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-15037 Elasticsearch StackOverflow vulnerability CVSS 3.1HIGH 7.5
- TI-2021-05135 Information disclosure in Elasticsearch CVSS 3.1MEDIUM 6.5
- TI-2021-05136 All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled… CVSS 3.1HIGH 7.5
- TI-2015-04530 Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via… CVSS 3.0CRITICAL 9.8
- TI-2022-07764 Improper check for unusual conditions in elasticsearch CVSS 3.1HIGH 7.5
Sources
- CVE-2014-3120 · CVE Program
- CVE-2014-3120 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-mrfm-jxgf-2h6v · GitHub Advisory Database · CC BY 4.0
- CVE-2014-3120 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences