CVE-2015-1427

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/534689/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/72585Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:0868Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/100850Third Party Advisory, VDB Entry
https://www.elastic.co/community/security/Not Applicable, Vendor Advisory
http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/Patch, Vendor Advisory
http://www.securityfocus.com/archive/1/534689/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/72585Broken Link, Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:0868Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/100850Third Party Advisory, VDB Entry
https://www.elastic.co/community/security/Not Applicable, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1427US Government Resource

Timeline

Published: Feb 17, 2015
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 25, 2022
NVD status: Analyzed

Related CVEs from 2015

CVE-2015-14287.5Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefreng CVE-2015-14297.5Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers CVE-2015-14309.8Buffer overflow in xymon 4.3.17-1.CVE-2015-14314.3Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web scri CVE-2015-14326.8The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows CVE-2015-14334.3program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct CVE-2015-14346.5Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the CVE-2015-14354.3Cross-site scripting (XSS) vulnerability in my little forum before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via CVE-2015-14364.3Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrar CVE-2015-14374.3Multiple cross-site scripting (XSS) vulnerabilities in Asus RT-N10+ D1 router with firmware 2.1.1.1.70 allow remote attackers to inject arbi CVE-2015-14387.8Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel pri CVE-2015-14417.5SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary