GHSA-x8q8-4hp5-463w

ghsaUSosv

Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch

view advisory published 2022-05-17Licence: CC-BY-4.0

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2015-3337US	medium4.3	33.2% (98th)	Exploit	2015-05-01
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecifi…

references

External citations — patches, advisories, analysis.

http://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.htmlWEB
http://www.debian.org/security/2015/dsa-3241WEB
https://nvd.nist.gov/vuln/detail/CVE-2015-3337ADVISORY
https://www.elastic.co/community/securityWEB
https://www.exploit-db.com/exploits/37054WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan