CVE-2015-1427: Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability

EPSS trend

Probability

99.91%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 99.91% on 18-09-2026

18-09-202618-10-2026

EPSS score

99.91%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 25-03-2022
Federal due date: 15-04-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2015-1427

Public exploits

4 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databaseremotejavaVerified
ElasticSearch - Search Groovy Sandbox Bypass (Metasploit)
Maturity: weaponized
exploit-databaseremotelinuxVerified
ElasticSearch - Remote Code Execution
Maturity: weaponized

Show all 4 exploits

MetasploitremoteVerified
ElasticSearch Search Groovy Sandbox Bypass
exploit/multi/elasticsearch/search_groovy_script
Maturity: weaponized

References

17 links

www.securityfocus.com/archive/1/534689/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB EntryWEB
access.redhat.com/errata/RHSA-2017:0868Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEB
www.securityfocus.com/bid/72585VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/X Refsource CONFIRMPatchVendor AdvisoryREPORT
exchange.xforce.ibmcloud.com/vulnerabilities/100850VDB EntryX Refsource XFThird Party AdvisoryWEB
packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.htmlX Refsource MISCThird Party AdvisoryVDB EntryREPORTWEB
www.elastic.co/community/security/X Refsource CONFIRMNot ApplicableVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1427Government ResourceUS Government Resource
ubuntu.com/security/CVE-2015-1427REPORT

Show all 17 references

Related vulnerabilities

CVE-2018-1270debianlibspring-java+3177.48%8y ago06-04-2018 13:00Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.CVE-2018-1199debianlibspring-java+92.92%8y ago16-03-2018 20:00Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.CVE-2018-1258org.springframeworkspring-core+422.46%8y ago11-05-2018 20:00Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.CVE-2021-4178io.fabric8kubernetes-client+90.34%4y ago24-08-2022 15:02A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.CVE-2021-3690debianundertow+101.77%4y ago23-08-2022 15:50A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.CVE-2021-3597debianundertow+101.16%4y ago24-05-2022 18:19A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.

All vulnerabilities inelasticsearch fuse

CVE-2015-1427: Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References