Read the docs
TI-2015-01295 Aliases CVE-2015-1427GHSA-w94p-6mhw-4qxw

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows…

Priority CRITICAL 100Exploited in the wildCWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.

Summary

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Why it matters now

Exploitation Active In CISA KEV since 2022-03-25CISA due date 2022-04-15
EPSS 0.99906 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.elasticsearch:elasticsearch (Maven): 1.3.8, 1.4.3Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.elasticsearch:elasticsearch (Maven)before 1.3.81.3.8Patch availableGHSA-w94p-6mhw-4qxw
—org.elasticsearch:elasticsearch (Maven)1.4.0 to before 1.4.31.4.3Patch availableGHSA-w94p-6mhw-4qxw
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.elasticsearch:elasticsearch (Maven) Vendor— Affected before 1.3.8 Fixed in 1.3.8 Patch available GHSA-w94p-6mhw-4qxw
  • org.elasticsearch:elasticsearch (Maven) Vendor— Affected 1.4.0 to before 1.4.3 Fixed in 1.4.3 Patch available GHSA-w94p-6mhw-4qxw

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*before 1.3.8; 1.4.0 to before 1.4.3VulnerableElastic
cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableRed Hat
  • cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:* Versions before 1.3.8; 1.4.0 to before 1.4.3 Vulnerable ·Elastic
  • cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-w94p-6mhw-4qxw org.elasticsearch:elasticsearch (Maven) Fixed in 1.3.8 Advisory →
  • Fix · GHSA-w94p-6mhw-4qxw org.elasticsearch:elasticsearch (Maven) Fixed in 1.4.3 Advisory →

Red Hat 1 advisory

  • RHSA-2017:0868 Released 2017-04-03 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update
    • Red Hat JBoss A-MQ 6.3
    • Red Hat JBoss Fuse 6.3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss A-MQ 6.3Fixed RHSA-2017:0868
Red Hat JBoss Fuse 6.3Fixed RHSA-2017:0868
Not affected: 3 products
  • Red Hat OpenShift Enterprise 2
  • Red Hat Satellite 6
  • Red Hat Subscription Asset Manager

Timeline

  1. 2022-03-25 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2015-1427
  3. 2026-10-03 Alias added: GHSA-w94p-6mhw-4qxw

References

Exploit 1

Patch 1

Advisory 4

Other 2

  • TI-2014-02491 The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which… KEVCVSS 3.1HIGH 8.1
  • TI-2023-15037 Elasticsearch StackOverflow vulnerability CVSS 3.1HIGH 7.5
  • TI-2021-05135 Information disclosure in Elasticsearch CVSS 3.1MEDIUM 6.5
  • TI-2021-05136 All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled… CVSS 3.1HIGH 7.5
  • TI-2015-04530 Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via… CVSS 3.0CRITICAL 9.8
  • TI-2022-07764 Improper check for unusual conditions in elasticsearch CVSS 3.1HIGH 7.5
See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences