CVE-2015-5377 Code injection in n/a
Remote attackers can execute arbitrary code on Elasticsearch servers via the transport protocol, requiring immediate upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-5377?
CVE-2015-5377 is a critical code injection vulnerability in Elastic Elasticsearch, published on 6 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability
Weakness: CWE-74
Which versions are affected by CVE-2015-5377?
It affects 1 product.
Products include Elastic Elasticsearch.
How do I fix CVE-2015-5377?
No fix has been published for CVE-2015-5377 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2015-5377 being exploited?
There is no known exploitation of CVE-2015-5377 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Elastic Elasticsearch
- CVE-2015-1427 Elasticsearch Groovy Scripting Engine Remote Code Execution
- CVE-2014-3120 Elasticsearch Remote Code Execution
- CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
- CVE-2026-72642 Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process
- CVE-2020-7014 Privilege Escalation Flaw in Elasticsearch
Sources
Also known as GHSA-vwpr-g44g-2pf3.