PT-2015-6160 · Elastic · Elasticsearch

John Heasman · Published 2015-04-29 · Updated 2022-05-17 · CVE-2015-3337

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 1.4.5 Elasticsearch versions 1.5.x prior to 1.5.2

Description A directory traversal issue allows remote attackers to read arbitrary files when a site plugin is enabled.

Recommendations For Elasticsearch versions prior to 1.4.5, update to version 1.4.5 or later. For Elasticsearch versions 1.5.x prior to 1.5.2, update to version 1.5.2 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2015-3337

DSA-3241-1

GHSA-X8Q8-4HP5-463W

Affected Products

Elasticsearch

References · 15

• 🔥 https://github.com/jas502n/CVE-2015-3337 · Exploit
• 🔥 https://exploit-db.com/exploits/37054 · Exploit
• 🔥 http://securityfocus.com/bid/74353 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3337 · Security Note
• https://osv.dev/vulnerability/GHSA-x8q8-4hp5-463w · Vendor Advisory
• http://debian.org/security/2015/dsa-3241 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3241-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3241-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/elasticsearch · Vendor Advisory
• https://elastic.co/community/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3337 · Security Note
• https://packages.debian.org/src:elasticsearch · Note
• http://securityfocus.com/archive/1/535385 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3337 · Note
• http://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html · Note