CVE-2014-3120
Elasticsearch Remote Code Execution Vulnerability
8.1
CVSS 3.1
88.6 %
EPSS (current)
2022-03-25
KEV addition
No
Ransomware
Timeline
Publication, first public exploit and KEV addition on a day axis.
Key facts
Vendor / product: Elastic / Elasticsearch
Published: 2014-07-28 · Due (CISA): 2022-04-15
CWE: CWE-284 · EU list: no
Exploit references (metadata only)
| Source | Reference | Title | Date |
|---|---|---|---|
| nuclei | http/cves/2014/CVE-2014-3120.yaml | ElasticSearch v1.1.1/1.2 RCE | – |
| metasploit | exploit/multi/elasticsearch/script_mvel_rce | exploit/multi/elasticsearch/script_mvel_rce | 2013-12-09 |
| exploitdb | 33370 | ElasticSearch - Remote Code Execution | 2014-05-15 |
| exploitdb | 33588 | ElasticSearch Dynamic Script - Arbitrary Java Execution (Metasploit) | 2014-05-30 |
References only — no downloads or instructions.