CVE-2014-6439 Cross-site scripting in Elasticsearch
MediumCVSS 4.3
EPSS 2.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.elasticsearch/elasticsearch(Maven) | < 1.4.0.Beta1 | 1.4.0.Beta1 |
| org.elasticsearch/elasticsearch(Maven) | = 0.10.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.11.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.12.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.12.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.13.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.13.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.14.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.14.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.14.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.14.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.14.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.15.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.15.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.15.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.16.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.16.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.16.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.16.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.16.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.16.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.10 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.2 | No fix listed |
Show 88 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.elasticsearch/elasticsearch(Maven) | = 0.17.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.6 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.7 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.8 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.9 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.6 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.7 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.0.RC1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.0.RC2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.0.RC3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.10 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.11 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.12 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.6 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.7 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.8 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.9 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.0.RC1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.6 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.6.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.7.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.7.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.8.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.9.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.0.Beta1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.0.RC1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.0.RC2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.10 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.11 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.12 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.13 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.6 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.7 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.8 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.9 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.0.Beta1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.0.Beta2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.0.RC1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.0.RC2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.1.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.1.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.1.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.2.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.2.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.2.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.2.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.2.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.6 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.7 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.8 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.9 | No fix listed |
| elasticsearch | <= 1.3.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- www.elastic.co vendor-advisory
- packetstormsecurity.com exploit
- www.elasticsearch.org patch vendor-advisory
- 20141002 Elasticsearch vulnerability CVE-2014-6439 mailing-list
- 70233 vdb-entry
- github.com