Elasticsearch CVE-2015-3337 Directory Traversal Vulnerability
BID:74353
Info
Elasticsearch CVE-2015-3337 Directory Traversal Vulnerability
| Bugtraq ID: | 74353 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-3337 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 27 2015 12:00AM |
| Updated: | Jul 15 2015 12:09AM |
| Credit: | John Heasman of DocuSign |
| Vulnerable: |
Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: | |
Discussion
Elasticsearch CVE-2015-3337 Directory Traversal Vulnerability
Elasticsearch is prone to a directory-traversal vulnerability.
A remote attacker could exploit this vulnerability using directory-traversal characters ('../') to access arbitrary files that contain sensitive information and perform other attacks.
Versions prior to Elasticsearch 1.5.2 and 1.4.5 are vulnerable.
Elasticsearch is prone to a directory-traversal vulnerability.
A remote attacker could exploit this vulnerability using directory-traversal characters ('../') to access arbitrary files that contain sensitive information and perform other attacks.
Versions prior to Elasticsearch 1.5.2 and 1.4.5 are vulnerable.
Exploit / POC
Elasticsearch CVE-2015-3337 Directory Traversal Vulnerability
The following exploit is available:
The following exploit is available:
Solution / Fix
Elasticsearch CVE-2015-3337 Directory Traversal Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Elasticsearch CVE-2015-3337 Directory Traversal Vulnerability
References:
References: