Medium CVE-2014-6439 EUVD-2022-3121GHSA-8699-m855-cwqf

Cross-site scripting in Elasticsearch

Published Oct 10, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Package: elasticsearch Package: org.elasticsearch:elasticsearch Ecosystem: Maven Ecosystem: Ubuntu

Description

Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	elasticsearch	No fix yet	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.elasticsearch:elasticsearch	< 1.4.0.Beta1	1.4.0.Beta1	GHSA-8699-m855-cwqf

References

http://www.elasticsearch.org/blog/elasticsearch-1-4-0-beta-released/
20141002 Elasticsearch vulnerability CVE-2014-6439 mailing-list
70233 vdb-entry
http://packetstormsecurity.com/files/128556/Elasticsearch-1.3.x-CORS-Issue.html
https://www.elastic.co/community/security/