{"api_version":"1","generated_at":"2026-07-23T18:56:55+00:00","cve":"CVE-2015-4152","urls":{"html":"https://cve.report/CVE-2015-4152","api":"https://cve.report/api/cve/CVE-2015-4152.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-4152","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-4152"},"summary":{"title":"CVE-2015-4152","description":"Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option.","state":"PUBLISHED","assigner":"mitre","published_at":"2015-06-15 15:59:11","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-22","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.4","severity":"","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://www.elastic.co/community/security/","name":"https://www.elastic.co/community/security/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security issues | Elastic","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/535725/100/0/threaded","name":"http://www.securityfocus.com/archive/1/535725/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/132233/Logstash-1.4.2-Directory-Traversal.html","name":"http://packetstormsecurity.com/files/132233/Logstash-1.4.2-Directory-Traversal.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Logstash 1.4.2 Directory Traversal ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.elastic.co/blog/logstash-1-4-3-released","name":"https://www.elastic.co/blog/logstash-1-4-3-released","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Logstash 1.4.3 released\n\t  \t | Elastic","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-4152","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-4152","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"4152","vulnerable":"1","versionEndIncluding":"1.4.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"elastic","cpe5":"logstash","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T06:04:02.978Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20150609 Logstash vulnerability CVE-2015-4152","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/535725/100/0/threaded"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.elastic.co/blog/logstash-1-4-3-released"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/132233/Logstash-1.4.2-Directory-Traversal.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.elastic.co/community/security/"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-06-09T00:00:00.000Z","descriptions":[{"lang":"en","value":"Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-09T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20150609 Logstash vulnerability CVE-2015-4152","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/535725/100/0/threaded"},{"tags":["x_refsource_CONFIRM"],"url":"https://www.elastic.co/blog/logstash-1-4-3-released"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/132233/Logstash-1.4.2-Directory-Traversal.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://www.elastic.co/community/security/"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2015-4152","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20150609 Logstash vulnerability CVE-2015-4152","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/535725/100/0/threaded"},{"name":"https://www.elastic.co/blog/logstash-1-4-3-released","refsource":"CONFIRM","url":"https://www.elastic.co/blog/logstash-1-4-3-released"},{"name":"http://packetstormsecurity.com/files/132233/Logstash-1.4.2-Directory-Traversal.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/132233/Logstash-1.4.2-Directory-Traversal.html"},{"name":"https://www.elastic.co/community/security/","refsource":"CONFIRM","url":"https://www.elastic.co/community/security/"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2015-4152","datePublished":"2015-06-15T15:00:00.000Z","dateReserved":"2015-06-01T00:00:00.000Z","dateUpdated":"2024-08-06T06:04:02.978Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-06-15 15:59:11","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-22","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elastic:logstash:*:*:*:*:*:*:*:*","versionEndIncluding":"1.4.2","matchCriteriaId":"2042FB04-763F-4C30-AF0A-2AD364852E8D"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"4152","Ordinal":"1","Title":"CVE-2015-4152","CVE":"CVE-2015-4152","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"4152","Ordinal":"1","NoteData":"Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option.","Type":"Description","Title":"CVE-2015-4152"},{"CveYear":"2015","CveId":"4152","Ordinal":"2","NoteData":"2015-06-15","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"4152","Ordinal":"3","NoteData":"2018-10-09","Type":"Other","Title":"Modified"}]}}}