CVE-2015-5377

high-risk
Published 2018-03-06

Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability

Do I need to act?

!
39.9% chance of exploitation in next 30 days
EPSS score — higher than 60% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Elastic

References (8)

Third Party Advisory http://www.securityfocus.com/bid/75938
Third Party Advisory http://www.zerodayinitiative.com/advisories/ZDI-15-365/
Vendor Advisory https://discuss.elastic.co/t/elasticsearch-remote-code-execution-cve-2015-5377/2...
Patch https://github.com/elastic/elasticsearch/commit/bf3052d14c874aead7da8855c5fcadf5...
Third Party Advisory http://www.securityfocus.com/bid/75938
Third Party Advisory http://www.zerodayinitiative.com/advisories/ZDI-15-365/
Vendor Advisory https://discuss.elastic.co/t/elasticsearch-remote-code-execution-cve-2015-5377/2...
Patch https://github.com/elastic/elasticsearch/commit/bf3052d14c874aead7da8855c5fcadf5...
54
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 17/34 · Moderate
Exposure 5/34 · Minimal