CVE Feed

    Dashboard / CVE / CVE-2014-3120

    CVE-2014-3120

    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

    Published:Dec 9, 2013
    Last Modified:Apr 22, 2026
    EPS:Jul 28, 2014
    EPSS Score:0.82597
    CVSS Score:8.1

    CISA Notification

    Description

    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

    Required Action:

    Apply updates per vendor instructions.

    Notes:

    No extra notes provided.

    Due Date
    Apr 15, 2022
    1610 days ago
    Alert Date
    Mar 25, 2022
    1631 days ago

    Affected Products

    Vendor
    Elastic
    Product
    Elasticsearch
    Vendor
    Redhat
    Product
    Fuse Esb Enterprise
    Vendor
    Redhat
    Product
    Fuse Management Console
    Vendor
    Redhat
    Product
    Fuse Mq Enterprise
    Vendor
    Redhat
    Product
    Jboss Amq
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Rhel Sam
    Product
    1.4

    Exploits

    http://bouk.co/blog/elasticsearch-rce/http://www.exploit-db.com/exploits/33370http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rcehttp://www.securityfocus.com/bid/67731https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearchhttp://bouk.co/blog/elasticsearch-rce/http://www.exploit-db.com/exploits/33370http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rcehttp://www.securityfocus.com/bid/67731https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearchhttps://www.exploit-db.com/exploits/33588https://github.com/Dungsocool/CVE-2014-3120https://github.com/echohtp/ElasticSearch-CVE-2014-3120https://github.com/jeffgeiger/es_injecthttps://github.com/xpgdgit/CVE-2014-3120https://www.exploit-db.com/exploits/33370

    Related CVEs

    CVE-2026-78607 (CVSS 5.4) — Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosu…
    CVE-2026-78605 (CVSS 5.9) — Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to…
    CVE-2026-72649 (CVSS 8.8) — Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote…
    CVE-2026-56143 (CVSS 4.9) — Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of servic…
    CVE-2026-72636 (CVSS 6.5) — Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service…
    CVE-2026-72642 (CVSS 8.8) — The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a mo…
    CVE-2026-72639 (CVSS 6.5) — Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting optio…
    CVE-2026-72638 (CVSS 6.5) — Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (C…
    CVE-2026-72647 (CVSS 6.5) — Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Neste…
    CVE-2026-72645 (CVSS 6.5) — Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Exces…

    References

    http://bouk.co/blog/elasticsearch-rce/
    http://www.exploit-db.com/exploits/33370
    http://www.osvdb.org/106949
    http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce
    http://www.securityfocus.com/bid/67731
    https://www.elastic.co/blog/logstash-1-4-3-released
    https://www.elastic.co/community/security/
    https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch
    http://bouk.co/blog/elasticsearch-rce/
    http://www.exploit-db.com/exploits/33370
    http://www.osvdb.org/106949
    http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce
    http://www.securityfocus.com/bid/67731
    https://www.elastic.co/blog/logstash-1-4-3-released
    https://www.elastic.co/community/security/
    https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High