GCVE - cpe:2.3:a:elasticsearch:elasticsearch:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:elasticsearch:elasticsearch:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Elasticsearch (`453210ca-2d0c-5f06-95bd-23f75cccb6c2`)
Product	Elasticsearch (`6bcea840-227d-5ed6-8f02-a3416ff4dbe9`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/elastic/elasticsearch`	purl2cpe	2026-06-01 10:16:25.592114
`pkg:maven/org.elasticsearch/elasticsearch`	purl2cpe	2026-06-01 10:16:25.592116
`pkg:sourceforge/elasticsearch.mirror`	purl2cpe	2026-06-01 10:16:25.592118

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-5531`	vulnerable	2026-06-08 05:06:50.350049	Details available Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. Published: 2015-08-17T15:00:00.000Z Updated: 2024-08-06T06:50:02.923Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/536017/100/0/threaded http://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html http://packetstormsecurity.com/files/133964/ElasticSearch-Snapshot-API-Directory-Traversal.html http://www.securityfocus.com/bid/75935 http://packetstormsecurity.com/files/133797/ElasticSearch-Path-Traversal-Arbitrary-File-Download.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3337`	vulnerable	2026-06-08 05:06:38.032264	Details available Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors. Published: 2015-05-01T15:00:00.000Z Updated: 2024-08-06T05:47:57.339Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/74353 http://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html http://www.securityfocus.com/archive/1/535385 https://www.exploit-db.com/exploits/37054/ https://www.elastic.co/community/security	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6439`	vulnerable	2026-06-08 05:05:57.686435	Details available Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Published: 2014-10-10T01:00:00.000Z Updated: 2024-08-06T12:17:23.821Z Open on db.gcve.eu Reference links http://www.elasticsearch.org/blog/elasticsearch-1-4-0-beta-released/ http://www.securityfocus.com/archive/1/533602/100/0/threaded http://www.securityfocus.com/bid/70233 http://packetstormsecurity.com/files/128556/Elasticsearch-1.3.x-CORS-Issue.html https://www.elastic.co/community/security/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3120`	vulnerable	2026-06-08 05:05:31.217546	Details available The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine. Published: 2014-07-28T19:00:00.000Z Updated: 2025-10-22T00:05:37.084Z Open on db.gcve.eu Reference links https://www.elastic.co/blog/logstash-1-4-3-released http://www.exploit-db.com/exploits/33370 http://www.securityfocus.com/bid/67731 http://www.osvdb.org/106949 http://bouk.co/blog/elasticsearch-rce/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.