DeutschShown in its original language — a full translation is planned for a future version.
Elasticsearch: Mehrere Schwachstellen ermöglichen Codeausführung und die Offenlegung von Informationen
view advisory published 2015-07-16
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Elasticsearch ausnutzen, um beliebigen Programmcode auszuführen und Informationen offenzulegen.
01
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-5377US | critical9.8 | Exploit | ||
Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-325… | ||||
| CVE-2015-5531US | medium5.0 | Exploit | ||
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. | ||||
02
references
External citations — patches, advisories, analysis.
- Elasticsearch Security Announcement vom 2015-07-16external
- Elasticsearch Security Announcement vom 2015-07-16external
- NetApp Security Advisory NTAP-20160623-0003 vom 2017-11-07external
- Juniper Security Advisory JSA103138 vom 2024-10-08external
- WID-SEC-W-2025-2234 - CSAF Versionself
- WID-SEC-2025-2234 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan