{"id":"CVE-2015-3337","published":"2015-05-01T15:00:00Z","modified":"2024-08-06T05:47:57Z","title":"Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled…","vendor":null,"product":null,"tier":"tail","description":{"text":"Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.3316,"percentile":0.9836,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/74353","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/archive/1/535385","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"https://www.exploit-db.com/exploits/37054/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://www.elastic.co/community/security","tags":["x_refsource_CONFIRM"]},{"url":"http://www.debian.org/security/2015/dsa-3241","tags":["vendor-advisory","x_refsource_DEBIAN"]}],"priority":{"score":24.7,"factors":[{"name":"EPSS percentile","points":19.67},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"exploitdb":{"count":1,"earliest":"2015-05-18"},"pocGithub":{"count":1,"skipped":0,"earliest":"2019-06-21","earliestUrl":"https://github.com/jas502n/CVE-2015-3337","repos":[{"name":"jas502n/CVE-2015-3337","url":"https://github.com/jas502n/CVE-2015-3337","stars":9,"created":"2019-06-21"}]},"nuclei":[{"id":"CVE-2015-3337","name":"Elasticsearch - Local File Inclusion","severity":"medium","path":"http/cves/2015/CVE-2015-3337.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3337.yaml"}],"first":{"date":"2015-05-18","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/37054"},"provenance":"source"},"affected":[{"ecosystem":"Maven","package":"org.elasticsearch:elasticsearch","vulnerableRanges":["<1.4.5",">=1.5.0, <1.5.2"],"patched":["1.4.5","1.5.2"],"from":["GHSA-x8q8-4hp5-463w"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5748","exploited":false,"provenance":"source"},"exploits":[{"id":37054,"url":"https://www.exploit-db.com/exploits/37054","title":"ElasticSearch < 1.4.5 / < 1.5.2 - Directory Traversal","date":"2015-05-18","verified":false,"provenance":"source"}],"exploitRefs":["https://www.exploit-db.com/exploits/37054/","http://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html","https://www.exploit-db.com/exploits/37054"],"lineage":{"packageHistory":[{"cve":"CVE-2014-3120","published":"2014-07-28","fixed":"1.4.0.Beta1","kev":true},{"cve":"CVE-2014-6439","published":"2014-10-10","fixed":"1.4.0.Beta1","kev":false},{"cve":"CVE-2015-1427","published":"2015-02-17","fixed":"1.4.3","kev":true,"link":{"from":"CVE-2015-1427","to":"CVE-2015-3337","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.elasticsearch:elasticsearch","fromFixed":"1.4.3","toFixed":"1.4.5","daysApart":73}]}},{"cve":"CVE-2015-3337","published":"2015-05-01","fixed":"1.5.2","kev":false},{"cve":"CVE-2015-4165","published":"2017-08-09","fixed":"1.6.0","kev":false},{"cve":"CVE-2015-5531","published":"2015-08-17","fixed":"1.6.1","kev":false},{"cve":"CVE-2018-3824","published":"2018-09-19","fixed":"6.2.4","kev":false}],"package":"Maven:org.elasticsearch:elasticsearch"}}