Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1     allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. (CVE-2014-6439)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1
    allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. (CVE-2014-6439)

Elastic reports :

Vulnerability Summary: Elasticsearch versions 1.3.x and prior have a default configuration for CORS that allows an attacker to craft links that could cause a user's browser to send requests to Elasticsearch instances on their local network. These requests could cause data loss or compromise.

Remediation Summary: Users should either set 'http.cors.enabled' to false, or set 'http.cors.allow-origin' to the value of the server that should be allowed access, such as localhost or a server hosting Kibana. Disabling CORS entirely with the former setting is more secure, but may not be suitable for all use cases.

ID	Name	Product	Family	Severity
271641	Linux Distros Unpatched Vulnerability : CVE-2014-6439	Nessus	Misc.	medium
412469	SCA: security update for org.elasticsearch:elasticsearch (GHSA-8699-m855-cwqf)	Tenable Cloud Security	SCA Checks	medium
412469	SCA: security update for org.elasticsearch:elasticsearch (GHSA-8699-m855-cwqf)	Tenable Self-Hosted Container Security	SCA Checks	medium
84412	FreeBSD : elasticsearch -- XSS vulnerability in the CORS functionality (5951fb49-1ba2-11e5-b43d-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-6439

medium

Tenable Plugins

medium

medium

medium

medium