CVE-2014-3120

high

Description

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

From the Tenable Blog

Patched Elasticsearch Vulnerabilities Used to Spread Cryptocurrency Miner (CVE-2014-3120, CVE-2015-1427)

Patched Elasticsearch Vulnerabilities Used to Spread Cryptocurrency Miner (CVE-2014-3120, CVE-2015-1427)

Published: 2018-12-13

Attackers are actively scanning for vulnerable Elasticsearch systems in order to implant cryptocurrency mining scripts.

References

https://www.greynoise.io/blog/coordinated-cloud-based-scanning-operation-targets-75-known-exposure-points

http://www.exploit-db.com/exploits/33370

https://www.tenable.com/blog/patched-elasticsearch-vulnerabilities-used-to-spread-cryptocurrency-miner-cve-2014-3120-cve

https://github.com/Dungsocool/CVE-2014-3120

https://github.com/Bhanunamikaze/VaktScan

https://github.com/jeffgeiger/es_inject

https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch

https://www.elastic.co/community/security/

https://www.elastic.co/blog/logstash-1-4-3-released

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120

http://www.securityfocus.com/bid/67731

http://www.osvdb.org/106949

http://bouk.co/blog/elasticsearch-rce/

Details

Source: Mitre, NVD

Published: 2014-07-28

Updated: 2026-06-17

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 8.1

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Severity: High

EPSS

EPSS: 0.88559