Elasticsearch Remote Code Execution Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jul 28, 2014 · Catalog

   Detected

   The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

2. Mar 25, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Apr 15, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

Affected

• cpe elastic/elasticsearchversion unspecified
• vendor Elastic Elasticsearchversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2014-3120

  Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.

  cisa.gov
• CVE.orgVulnerability recordCVE-2014-3120

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2014-3120

  30-day exploitation probability 88.6%

  first.org
• Exploit DatabasePublic exploit reference33370

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Exploit DatabasePublic exploit reference33588

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Metasploit ModulesPublic exploit moduleexploit_multi/elasticsearch/script_mvel_rce

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDVulnerability recordCVE-2014-3120

  The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does

  nvd.nist.gov

References

• Exploit · bouk.co
• Exploit · exploit-db.com
• Broken Link · osvdb.org
• Exploit · rapid7.com
• CISA note · nvd.nist.gov
• Vendor Advisory · elastic.co
• Vendor Advisory · elastic.co