CVE-2015-3337 Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch
MediumCVSS 4.3
EPSS 33.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.elasticsearch/elasticsearch(Maven) | <= 1.4.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | >= 1.5.0, <= 1.5.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | < 1.4.5 | 1.4.5 |
| org.elasticsearch/elasticsearch(Maven) | = 0.10.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.11.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.12.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.12.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.13.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.13.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.14.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.14.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.14.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.14.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.14.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.15.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.15.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.15.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.16.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.16.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.16.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.16.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.16.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.16.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.1 | No fix listed |
Show 101 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.elasticsearch/elasticsearch(Maven) | = 0.17.10 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.6 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.7 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.8 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.17.9 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.6 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.18.7 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.0.RC1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.0.RC2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.0.RC3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.10 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.11 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.12 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.6 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.7 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.8 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.19.9 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.0.RC1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.20.6 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.6.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.7.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.7.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.8.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.9.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.0.Beta1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.0.RC1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.0.RC2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.10 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.11 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.12 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.13 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.6 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.7 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.8 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 0.90.9 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.0.Beta1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.0.Beta2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.0.RC1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.0.RC2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.0.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.1.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.1.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.1.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.2.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.2.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.2.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.2.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.2.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.5 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.6 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.7 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.8 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.3.9 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.4.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.4.0.Beta1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.4.1 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.4.2 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.4.3 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.4.4 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | >= 1.5.0, < 1.5.2 | 1.5.2 |
| org.elasticsearch/elasticsearch(Maven) | = 1.5.0 | No fix listed |
| org.elasticsearch/elasticsearch(Maven) | = 1.5.1 | No fix listed |
| elasticsearch | <= 1.4.4 | No fix listed |
| elasticsearch | = 1.5.0 | No fix listed |
| elasticsearch | = 1.5.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- www.elastic.co patch vendor-advisory
- 37054 exploit
- packetstormsecurity.com exploit
- DSA-3241 vendor-advisory
- github.com
- 20150427 Elasticsearch vulnerability CVE-2015-3337 mailing-list
- 74353 exploit vdb-entry