Every CVE Search/ Get API key

CVE-2015-1427

Improper Access Control in Elasticsearch

9.8 CriticalIn KEVPublic exploitFix available

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

99.9%Up 24.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Record
CVE-2015-1427
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List 9.8

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Record
CVE-2015-1427
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
EUVDEUVD-2022-5539 9.8

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Record
EUVD-2022-5539
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-w94p-6mhw-4qxw No score

Improper Access Control in Elasticsearch

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Record
GHSA-w94p-6mhw-4qxw
Weakness
CWE-284
Updated
2026-11-02
CISA KEV No score

Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability

The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.

Record
CVE-2015-1427
Weakness
CWE-284
Updated
2026-11-02
OSVUBUNTU-CVE-2015-1427 9.8

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Record
UBUNTU-CVE-2015-1427
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-w94p-6mhw-4qxw No score

Improper Access Control in Elasticsearch

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

Record
GHSA-w94p-6mhw-4qxw
Weakness
CWE-284
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.elasticsearch:elasticsearch
Maven
 through 1.3.7
1.3.8
org.elasticsearch:elasticsearch
Maven
 1.4.0 to 1.4.2
1.4.3
org.elasticsearch:elasticsearch
Maven
 before 1.3.8, plus listed versions
0.10.00.11.00.12.00.12.10.13.0
Show 45 moreShow less
0.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.16.20.16.30.16.40.16.50.17.00.17.10.17.100.17.20.17.30.17.40.17.50.17.60.17.70.17.80.17.90.18.00.18.10.18.20.18.30.18.40.18.50.18.60.18.70.19.00.19.0.RC10.19.0.RC20.19.0.RC30.19.10.19.100.19.110.19.120.19.20.19.30.19.4
1.3.8
org.elasticsearch:elasticsearch
Maven
 1.4.0 up to 1.4.3, plus listed versions
1.4.11.4.2
1.4.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitElasticSearch Search Groovy Sandbox Bypass2015-02-11
Exploit-DBElasticSearch - Remote Code Execution2015-03-11
Exploit-DBElasticSearch - Search Groovy Sandbox Bypass (Metasploit)2015-03-16
PoC in GitHubt0kx/exploit-CVE-2015-14272017-01-09
PoC in GitHubcved-sources/cve-2015-14272019-01-06
PoC in GitHubcyberharsh/Groovy-scripting-engine-CVE-2015-14272020-06-22
PoC in GitHubxpgdgit/CVE-2015-14272022-07-29
PoC in GitHubSebikea/CVE-2015-1427-for-trixie2024-11-10
PoC in GitHubCyberCTF/vulhub-elasticsearch-cve-2015-14272026-10-08
NucleiElasticSearch - Remote Code Execution

History

History
RecordedChangedSources
exploitation, exploits
affected, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-1427 is a critical vulnerability (CVSS 9.8) in Elastic Elasticsearch, published February 17, 2015. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.9%, the 99th percentile. Fixed in org.elasticsearch:elasticsearch 1.3.8.

References

Show 10 moreShow less
This page doesn't list everything

Left out here: 59 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open