CVE-2014-3120
Elasticsearch Improper Access Control vulnerability
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
- Record
CVE-2014-3120- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
- Record
CVE-2014-3120- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2022-5879
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
- Record
EUVD-2022-5879- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mrfm-jxgf-2h6v
Elasticsearch Improper Access Control vulnerability
The default configuration in Elasticsearch before 1.4.0.Beta1 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
- Record
GHSA-mrfm-jxgf-2h6v- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:H - Weakness
- CWE-284
- Updated
- 2026-11-02
CISA KEV No score
Elasticsearch Remote Code Execution Vulnerability
Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.
- Record
CVE-2014-3120- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-mrfm-jxgf-2h6v
Elasticsearch Improper Access Control vulnerability
The default configuration in Elasticsearch before 1.4.0.Beta1 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
- Record
GHSA-mrfm-jxgf-2h6v- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:H - Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.elasticsearch:elasticsearchMaven |
before 1.4.0.Beta1 | 1.4.0.Beta1 |
org.elasticsearch:elasticsearchMaven |
before 1.4.0.Beta1, plus listed versions 0.10.00.11.00.12.00.12.10.13.0 Show 45 moreShow less0.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.16.20.16.30.16.40.16.50.17.00.17.10.17.100.17.20.17.30.17.40.17.50.17.60.17.70.17.80.17.90.18.00.18.10.18.20.18.30.18.40.18.50.18.60.18.70.19.00.19.0.RC10.19.0.RC20.19.0.RC30.19.10.19.100.19.110.19.120.19.20.19.30.19.4 |
1.4.0.Beta1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | ElasticSearch Dynamic Script Arbitrary Java Execution | 2013-12-09 |
| PoC in GitHub | jeffgeiger/es_inject | 2014-05-13 |
| Exploit-DB | ElasticSearch - Remote Code Execution | 2014-05-15 |
| Exploit-DB | ElasticSearch Dynamic Script - Arbitrary Java Execution (Metasploit) | 2014-05-30 |
| PoC in GitHub | echohtp/ElasticSearch-CVE-2014-3120 | 2014-07-07 |
| PoC in GitHub | xpgdgit/CVE-2014-3120 | 2022-08-01 |
| PoC in GitHub | Dungsocool/CVE-2014-3120 | 2026-05-31 |
| PoC in GitHub | CyberCTF/vulhub-elasticsearch-cve-2014-3120 | 2026-10-08 |
| Nuclei | ElasticSearch v1.1.1/1.2 RCE |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3120 is a high vulnerability (CVSS 8.1) in Elastic Elasticsearch, published July 28, 2014. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 88.6%, the 99th percentile. Fixed in org.elasticsearch:elasticsearch 1.4.0.Beta1.
References
elastic.co/blog/logstash-1-4-3-released
exploit-db.com/exploits/33370
securityfocus.com/bid/67731
osvdb.org/106949
bouk.co/blog/elasticsearch-rce
rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce
Show 11 moreShow less
found.no/foundation/elasticsearch-security
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3120
nvd.nist.gov/vuln/detail/CVE-2014-3120
github.com/elastic/elasticsearch/issues/7151
web.archive.org/web/20140813071419/http://www.securityfocus.com/bid/67731
Left out here: 61 versions. The JSON record has them.