PT-2015-6160 · Elastic · Elasticsearch

John Heasman · Publicado 2015-04-29 · Atualizado 2022-05-17 · CVE-2015-3337

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 1.4.5 Elasticsearch versions 1.5.x prior to 1.5.2

Description A directory traversal issue allows remote attackers to read arbitrary files when a site plugin is enabled.

Recommendations For Elasticsearch versions prior to 1.4.5, update to version 1.4.5 or later. For Elasticsearch versions 1.5.x prior to 1.5.2, update to version 1.5.2 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2015-3337

DSA-3241-1

GHSA-X8Q8-4HP5-463W

Produtos afetados

Elasticsearch

Referências · 15

• 🔥 https://github.com/jas502n/CVE-2015-3337 · Exploit
• 🔥 https://exploit-db.com/exploits/37054 · Exploit
• 🔥 http://securityfocus.com/bid/74353 · Exploit
• https://packages.debian.org/src:elasticsearch · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3337 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-x8q8-4hp5-463w · Aviso do Fabricante
• http://debian.org/security/2015/dsa-3241 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-3241-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3241-1 · Aviso do Fabricante
• http://securityfocus.com/archive/1/535385 · Nota
• https://security-tracker.debian.org/tracker/source-package/elasticsearch · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3337 · Nota
• https://elastic.co/community/security · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-3337 · Nota de Segurança
• http://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html · Nota