Servers and applications
CVE-2015-1427
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 25 Mar 2022.
- Severity
- Critical 9.8
- Published
- 17 Feb 2015
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 21 Oct 2026
- Fixed in
- 1.3.8, 1.4.3
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
ElasticsearchServers and applications · cpe:a:elastic:elasticsearch |
|
Known exploited
- CISA name
- Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
- Required action
- Apply updates per vendor instructions.
- Due for US agencies
- 15 Apr 2022
- Used in ransomware
- Not known