CVE-2015-5377

CRITICAL 9.8CVE-2015-5377 · Published 06/03/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
elasticsearch elastic	`< 1.6.1`	`1.6.1`

Description

Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability

References

securityfocus.com/bid/75938 · Third Party Advisory
zerodayinitiative.com/advisories/ZDI-15-365 · Third Party Advisory
discuss.elastic.co/t/elasticsearch-remote-code-execution-cve-2015-5377/25736 · Vendor Advisory
elastic/elasticsearch commit bf3052d · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free