Live › vulnerability › CVE-2014-3120
Go to dashboardElasticsearch before 1.2.0 enables dynamic scripting by default, so anyone who can reach the HTTP API (port 9200) can send a _search request with a script in the source parameter and run MVEL/Java code on the host. Exploited in the wild (CISA KEV). Elastic's own mitigation is to put the cluster behind a firewall, not run as root, and disable dynamic scripting.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Elastic Elasticsearch | vendor | – | – |
| Elasticsearch | vendor | < 1.2.0 (NVD); < 1.4.0.Beta1 (GHSA) | 1.2.0, 1.4.0.Beta1 |
1.2.0 is vulnerable by default. 1.2.x-1.3.x are default-off but vulnerable if elasticsearch.yml sets script.disable_dynamic: false; GHSA treats anything below 1.4.0.Beta1 as affected1.2.0 or later (dynamic scripting off by default); 1.4.0.Beta1 or later per GHSA, and in practice any currently supported releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
This page as .md · .json · in your agent: get_signal("CVE-2014-3120")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.