$ cve CVE-2015-1427 JSON

CVE-2015-1427 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 99.9% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-04-15.

Description

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	99.91% — more likely to be exploited than 100% of all CVEs
On CISA KEV	yes — remediate by 2022-04-15
Public exploit	yes
Published	2015-02-17
Last modified	2026-06-17

CISA KEV

Name	Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
Added	2022-03-25
Due	2022-04-15
Vendor / product	Elastic / Elasticsearch
Ransomware use	none reported

Affected (2)

Vendor	Product
elastic	elasticsearch
redhat	fuse

Public exploits

Source	Title	Date
exploit-db	ElasticSearch - Search Groovy Sandbox Bypass (Metasploit)	2015-03-16
exploit-db	ElasticSearch - Remote Code Execution	2015-03-11

References

→ the Explorer · watch your stack · NVD