Elasticsearch: Mehrere Schwachstellen ermöglichen Codeausführung und die Offenlegung von Informationen

Summary

Product

Vulnerabilities 2

• Unscored —
  CVE-2015-5377 Public exploit EPSS 14%

  Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the tran…

  Mar 6, 2018
• Medium —
  CVE-2015-5531 Public exploit Scanner template EPSS 95%

  Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch

  Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.

  org.elasticsearch:elasticsearch Maven
  Aug 17, 2015

Revision history

1. 2025-10-08 #4

   Neue Updates von Juniper aufgenommen

2. 2017-11-06 #3

   New remediations available

3. 2015-07-16 #1

   Initial Release

4. 2015-07-16 #2

   Version nicht vorhanden

References

• Elasticsearch Security Announcement vom 2015-07-16
  https://discuss.elastic.co/t/elasticsearch-remote-code-execution-cve-2015-5377/25736/1
• Elasticsearch Security Announcement vom 2015-07-16
  https://discuss.elastic.co/t/elasticsearch-directory-traversal-vulnerability-cve-2015-5531/25737
• NetApp Security Advisory NTAP-20160623-0003 vom 2017-11-07
  https://security.netapp.com/advisory/ntap-20160623-0003/
• Juniper Security Advisory JSA103138 vom 2024-10-08
  https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Security-Director-Multiple-vulnerabilities-resolved-in-24-1R4-by-upgrading-Log4j-Java-library-to-2-23-1-and-ElasticSearch-to-6-8-17