CVE-2014-3120
High 8.1 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Elasticsearch Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Metrics
- CVSS 3.1
-
8.1 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - EPSS — exploit probability
- 89% (percentile: 100) as of 1 November 2026
- CWE
- CWE-284
Affected products
elastic: elasticsearch
References
- https://www.elastic.co/blog/logstash-1-4-3-released Vendor Advisory
- https://www.elastic.co/community/security/ Vendor Advisory
- https://www.elastic.co/blog/logstash-1-4-3-released Vendor Advisory
- https://www.elastic.co/community/security/ Vendor Advisory
- http://bouk.co/blog/elasticsearch-rce/ Exploit
- http://www.exploit-db.com/exploits/33370 Exploit
- http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce ExploitThird Party Advisory
- http://www.securityfocus.com/bid/67731 Exploit
- https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-deve… Exploit
- http://bouk.co/blog/elasticsearch-rce/ Exploit