Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch

Description

References

• nvd.nist.gov/vuln/detail/CVE-2015-5531 · ADVISORY
• elastic.co/community/security · WEB
• exploit-db.com/exploits/38383 · WEB
• packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html · WEB
• packetstormsecurity.com/files/133797/ElasticSearch-Path-Traversal-Arbitrary-File-Download.html · WEB
• packetstormsecurity.com/files/133964/ElasticSearch-Snapshot-API-Directory-Traversal.html · WEB
• securityfocus.com/archive/1/536017/100/0/threaded
• securityfocus.com/bid/75935
• elastic.co/community/security · Vendor Advisory
• exploit-db.com/exploits/38383

Mais vulnerabilidades de org.elasticsearch:elasticsearch

• CVE-2024-52979ALTO 7.5Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead t…
• CVE-2024-52981ALTO 7.5An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection o…
• CVE-2024-43709ALTO 7.5An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via …
• CVE-2024-12539MÉDIO 6.5An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Docu…
• CVE-2024-23444ALTO 7.5It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Cert…