CVE-2015-4152

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to dynamic field references in the path option.

Metrics

CVSS 2.0 6.4/10AV:N/AC:L/Au:N/C:N/I:P/A:P

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jun 15, 2015
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-41535.0Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and eCVE-2015-41553.6GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to arCVE-2015-41563.6GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files viaCVE-2015-41575.0SAP Content Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security NoteCVE-2015-41585.0SAP ABAP & Java Server allows remote attackers to cause a denial of service (service termination) via unspecified vectors, aka SAP Security CVE-2015-41597.5SQL injection vulnerability in SAP HANA Web-based Development Workbench allows remote attackers to execute arbitrary SQL commands via unspecCVE-2015-41607.5SQL injection vulnerability in SAP ASE Database Platform allows remote attackers to execute arbitrary SQL commands via unspecified vectors, CVE-2015-41617.5SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gaCVE-2015-41624.0XML external entity (XXE) vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allowsCVE-2015-41634.9GNTTABOP_swap_grant_ref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause aCVE-2015-41644.9The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to CVE-2015-41657.5The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code fro