CVE-2015-1427
Critical 9.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% (percentile: 100) as of 1 November 2026
Affected products
elastic: elasticsearch; redhat: fuse
References
- http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/ PatchVendor Advisory
- https://www.elastic.co/community/security/ Not ApplicableVendor Advisory
- http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/ PatchVendor Advisory
- https://www.elastic.co/community/security/ Not ApplicableVendor Advisory
- http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remot… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remot… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-E… Third Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/534689/100/0/threaded Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/72585 Broken LinkThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:0868 Third Party Advisory