# org.elasticsearch:elasticsearch (Maven) vulnerabilities

40 known vulnerabilities (1 critical, 2 high, 13 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 9.5.6 (Nov 2, 2026): no advisory affects it
- Newest unaffected release: 9.5.6 (Nov 2, 2026), the latest release
- Dependents: 10
- Releases: 500+ since 0.16.0 (Apr 23, 2011)
- Registry: https://central.sonatype.com/artifact/org.elasticsearch/elasticsearch
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2024-52979: 0.16.0 to 7.17.24 (7.17.25 is outside it); 8.0.0-alpha1 to 8.15.5 (8.16.0 is outside it)
- CVE-2024-52981: 7.17.0 to 7.17.23 (7.17.24 is outside it); 8.0.0-alpha1 to 8.15.0 (8.15.1 is outside it)
- CVE-2024-43709: 0.16.0 to 7.17.20 (7.17.21 is outside it); 8.0.0 to 8.13.2 (8.13.3 is outside it)
- CVE-2024-12539: 8.16.0 to 8.16.1 (8.16.2 is outside it)
- CVE-2024-23444: 0.16.0 to 7.17.22 (7.17.23 is outside it); 8.0.0-alpha1 to 8.12.2 (8.13.0 is outside it)
- CVE-2023-49921: 0.16.0 to 7.17.15 (7.17.16 is outside it); 8.0.0 to 8.11.1 (8.11.2 is outside it)
- CVE-2024-37280: 8.13.1 to 8.13.4 (8.14.0 is outside it)
- CVE-2024-23449: 8.4.0 to 8.11.0 (8.11.1 is outside it)
- CVE-2024-23451: 8.10.0 to 8.12.2 (8.13.0 is outside it)
- CVE-2024-23450: 7.0.0 to 7.17.18 (7.17.19 is outside it); 8.0.0 to 8.12.2 (8.13.0 is outside it)
- CVE-2023-46673: 7.0.0 to 7.17.13 (7.17.14 is outside it); 8.0.0 to 8.10.2 (8.10.3 is outside it)
- CVE-2023-31417: 7.0.0 to 7.17.12 (7.17.13 is outside it); 8.0.0 to 8.9.1 (8.9.2 is outside it)
- CVE-2023-31418: 0.16.0 to 7.17.12 (7.17.13 is outside it); 8.0.0 to 8.8.2 (8.9.0 is outside it)
- CVE-2023-31419: 7.0.0 to 7.17.12 (7.17.13 is outside it); 8.0.0 to 8.9.0 (8.9.1 is outside it)
- CVE-2022-23712: 8.0.0 to 8.2.0 (8.2.1 is outside it)
- CVE-2022-23708: 7.16.0 to 7.17.0 (7.17.1 is outside it)
- CVE-2021-22147: 7.11.0 to 7.13.4 (7.14.0 is outside it)
- CVE-2021-22144: 0.16.0 to 6.8.16 (6.8.17 is outside it); 7.0.0-alpha1 to 7.13.2 (7.13.3 is outside it)
- CVE-2021-22137: 0.16.0 to 6.8.14 (6.8.15 is outside it); 7.11.0 to 7.11.1 (7.11.2 is outside it)
- CVE-2021-22135: 0.16.0 to 6.8.14 (6.8.15 is outside it); 7.0.0 to 7.11.1 (7.11.2 is outside it)
- CVE-2021-22134: 7.6.0 to 7.10.2 (7.11.0 is outside it)
- CVE-2020-7021: 0.16.0 to 6.8.13 (6.8.14 is outside it); 7.0.0 to 7.9.3 (7.10.0 is outside it)
- CVE-2021-22132: 7.7.0 to 7.10.1 (7.10.2 is outside it)
- CVE-2020-7020: 0.16.0 to 6.8.12 (6.8.13 is outside it); 7.0.0 to 7.9.1 (7.9.2 is outside it)
- CVE-2020-7019: 0.16.0 to 6.8.11 (6.8.12 is outside it); 7.0.0 to 7.8.1 (7.9.0 is outside it)
- CVE-2020-7014: 6.7.0 to 6.8.7 (6.8.8 is outside it); 7.0.0 to 7.6.1 (7.6.2 is outside it)
- CVE-2020-7009: 6.7.0 to 6.8.7 (6.8.8 is outside it); 7.0.0 to 7.6.1 (7.6.2 is outside it)
- CVE-2019-7619: 6.7.0 to 6.8.3 (6.8.4 is outside it); 7.0.0 to 7.3.2 (7.4.0 is outside it)
- CVE-2019-7614: 0.16.0 to 6.8.1 (6.8.2 is outside it); 7.0.0 to 7.2.0 (7.2.1 is outside it)
- CVE-2019-7611: 0.16.0 to 5.6.14 (5.6.15 is outside it); 6.0.0 to 6.6.0 (6.6.1 is outside it)
- CVE-2018-17247: 6.5.0 to 6.5.1 (6.5.2 is outside it)
- CVE-2018-17244: 6.4.0 to 6.4.2 (6.4.3 is outside it)
- CVE-2018-3831: 5.6.0 to 5.6.11 (5.6.12 is outside it); 6.0.0 to 6.4.0 (6.4.1 is outside it)
- CVE-2018-3824: 0.16.0 to 5.6.8 (5.6.9 is outside it); 6.0.0 to 6.2.3 (6.2.4 is outside it)
- CVE-2015-4165: 0.16.0 to 1.5.2 (1.6.0 is outside it)
- CVE-2015-5531: 0.16.0 to 1.6.0 (1.6.1 is outside it)
- CVE-2015-3337: 0.16.0 to 1.4.4 (1.4.5 is outside it); 1.5.0 to 1.5.1 (1.5.2 is outside it)
- CVE-2015-1427: 0.16.0 to 1.3.7 (1.3.8 is outside it); 1.4.0 to 1.4.2 (1.4.3 is outside it)
- CVE-2014-6439: 0.16.0 to 1.3.9 (1.4.0.Beta1 is outside it)
- CVE-2014-3120: 0.16.0 to 1.3.9 (1.4.0.Beta1 is outside it)

Older releases aren't stored, so the earliest spans may start sooner.

## Advisories (40)

### [CVE-2024-52979](https://cve.now/CVE-2024-52979): Elasticsearch Uncontrolled Resource Consumption vulnerability

- Severity: Medium 6.5
- Published: May 1, 2025
- Affected: fixed in 7.17.25; from 8.0.0-alpha1, fixed in 8.16.0.
- Fixed in 7.17.25 (released Oct 21, 2024, 192 days before disclosure) and 8.16.0 (released Nov 12, 2024, 170 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2024-52981](https://cve.now/CVE-2024-52981): An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection…

- Severity: Medium 4.9
- Published: Apr 8, 2025
- Affected: from 7.17.0, fixed in 7.17.24; from 8.0.0-alpha1, fixed in 8.15.1.
- Fixed in 7.17.24 (released Sep 9, 2024, 211 days before disclosure) and 8.15.1 (released Sep 3, 2024, 217 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2024-43709](https://cve.now/CVE-2024-43709): Elasticsearch allocation of resources without limits or throttling leads to crash

- Severity: Medium 6.5
- Published: Jan 21, 2025
- Affected: fixed in 7.17.21; from 8.0.0, fixed in 8.13.3.
- Fixed in 7.17.21 (released Apr 30, 2024, 266 days before disclosure) and 8.13.3 (released Apr 30, 2024, 266 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2024-12539](https://cve.now/CVE-2024-12539): Elasticsearch Incorrect Authorization

- Severity: Medium 6.0
- Published: Dec 17, 2024
- Affected: from 8.16.0, fixed in 8.16.2.
- Fixed in 8.16.2 (released Dec 12, 2024, 5 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2024-23444](https://cve.now/CVE-2024-23444): Elasticsearch elasticsearch-certutil csr fails to encrypt private key

- Severity: Medium 4.9
- Published: Jul 31, 2024
- Affected: from 8.0.0-alpha1, fixed in 8.13.0; fixed in 7.17.23.
- Fixed in 7.17.23 (released Jul 30, 2024, 1 day before disclosure) and 8.13.0 (released Mar 26, 2024, 127 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2023-49921](https://cve.now/CVE-2023-49921): An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level.

- Severity: Medium 5.2
- Published: Jul 26, 2024
- Affected: fixed in 7.17.16; from 8.0.0, fixed in 8.11.2.
- Fixed in 7.17.16 (released Dec 11, 2023, 228 days before disclosure) and 8.11.2 (released Dec 5, 2023, 234 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2024-37280](https://cve.now/CVE-2024-37280): Elasticsearch StackOverflow vulnerability

- Severity: Medium 4.9
- Published: Jun 13, 2024
- Affected: from 8.13.1, fixed in 8.14.0.
- Fixed in 8.14.0 (released Jun 3, 2024, 10 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2024-23449](https://cve.now/CVE-2024-23449): Elasticsearch Uncaught Exception

- Severity: Medium 4.3
- Published: Mar 29, 2024
- Affected: from 8.4.0, fixed in 8.11.1.
- Fixed in 8.11.1 (released Nov 11, 2023, 139 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2024-23451](https://cve.now/CVE-2024-23451): Elasticsearch Incorrect Authorization in the Remote Cluster Security API key based security model

- Severity: Medium 4.4
- Published: Mar 27, 2024
- Affected: from 8.10.0, fixed in 8.13.0.
- Fixed in 8.13.0 (released Mar 26, 2024, 1 day before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2024-23450](https://cve.now/CVE-2024-23450): Elasticsearch Uncontrolled Resource Consumption vulnerability

- Severity: Medium 4.9
- Published: Mar 27, 2024
- Affected: from 7.0.0, fixed in 7.17.19; from 8.0.0, fixed in 8.13.0.
- Fixed in 7.17.19 (released Mar 25, 2024, 2 days before disclosure) and 8.13.0 (released Mar 26, 2024, 1 day before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2023-46673](https://cve.now/CVE-2023-46673): It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash…

- Severity: Medium 6.5
- Published: Nov 22, 2023
- Affected: from 7.0.0, fixed in 7.17.14; from 8.0.0, fixed in 8.10.3.
- Fixed in 7.17.14 (released Oct 8, 2023, 45 days before disclosure) and 8.10.3 (released Oct 8, 2023, 45 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2023-31417](https://cve.now/CVE-2023-31417): Elasticsearch Insertion of sensitive information in audit logs

- Severity: Medium 4.1
- Published: Oct 26, 2023
- Affected: from 7.0.0, fixed in 7.17.13; from 8.0.0, fixed in 8.9.2.
- Fixed in 7.17.13 (released Sep 6, 2023, 50 days before disclosure) and 8.9.2 (released Sep 6, 2023, 50 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2023-31418](https://cve.now/CVE-2023-31418): Elasticsearch uncontrolled resource consumption

- Severity: High 7.5
- Published: Oct 26, 2023
- Affected: fixed in 7.17.13; from 8.0.0, fixed in 8.9.0.
- Fixed in 7.17.13 (released Sep 6, 2023, 50 days before disclosure) and 8.9.0 (released Jul 24, 2023, 94 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2023-31419](https://cve.now/CVE-2023-31419): Elasticsearch StackOverflow vulnerability

- Severity: Medium 6.5
- Published: Oct 26, 2023
- Affected: from 7.0.0, fixed in 7.17.13; from 8.0.0, fixed in 8.9.1.
- Fixed in 7.17.13 (released Sep 6, 2023, 50 days before disclosure) and 8.9.1 (released Aug 17, 2023, 70 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2022-23712](https://cve.now/CVE-2022-23712): A Denial of Service flaw was discovered in Elasticsearch.

- Severity: Unrated
- Published: Jun 6, 2022
- Affected: from 8.0.0, fixed in 8.2.1.
- Fixed in 8.2.1 (released May 24, 2022, 13 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2022-23708](https://cve.now/CVE-2022-23708): A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built…

- Severity: Unrated
- Published: Mar 3, 2022
- Affected: from 7.16.0, fixed in 7.17.1.
- Fixed in 7.17.1 (released Feb 28, 2022, 3 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2021-22147](https://cve.now/CVE-2021-22147): Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots.

- Severity: Unrated
- Published: Sep 15, 2021
- Affected: from 7.11.0, fixed in 7.14.0.
- Fixed in 7.14.0 (released Aug 3, 2021, 43 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2021-22144](https://cve.now/CVE-2021-22144): In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack…

- Severity: Unrated
- Published: Jul 26, 2021
- Affected: fixed in 6.8.17; from 7.0.0-alpha1, fixed in 7.13.3.
- Fixed in 6.8.17 (released Jul 7, 2021, 19 days before disclosure) and 7.13.3 (released Jul 7, 2021, 19 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2021-22137](https://cve.now/CVE-2021-22137): In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used.

- Severity: Unrated
- Published: May 13, 2021
- Affected: from 7.11.0, fixed in 7.11.2; fixed in 6.8.15.
- Fixed in 6.8.15 (released Mar 23, 2021, 51 days before disclosure) and 7.11.2 (released Mar 10, 2021, 64 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2021-22135](https://cve.now/CVE-2021-22135): Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile…

- Severity: Unrated
- Published: May 13, 2021
- Affected: from 7.0.0, fixed in 7.11.2; fixed in 6.8.15.
- Fixed in 6.8.15 (released Mar 23, 2021, 51 days before disclosure) and 7.11.2 (released Mar 10, 2021, 64 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2021-22134](https://cve.now/CVE-2021-22134): A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used.

- Severity: Unrated
- Published: Mar 8, 2021
- Affected: from 7.6.0, fixed in 7.11.0.
- Fixed in 7.11.0 (released Feb 10, 2021, 26 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2020-7021](https://cve.now/CVE-2020-7021): Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit\_request\_body option…

- Severity: Unrated
- Published: Feb 10, 2021
- Affected: fixed in 6.8.14; from 7.0.0, fixed in 7.10.0.
- Fixed in 6.8.14 (released Feb 10, 2021, the day of disclosure) and 7.10.0 (released Nov 11, 2020, 91 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2021-22132](https://cve.now/CVE-2021-22132): Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API.

- Severity: Unrated
- Published: Jan 14, 2021
- Affected: from 7.7.0, fixed in 7.10.2.
- Fixed in 7.10.2 (released Jan 15, 2021, 1 day after disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2020-7020](https://cve.now/CVE-2020-7020): Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used.

- Severity: Unrated
- Published: Oct 22, 2020
- Affected: fixed in 6.8.13; from 7.0.0, fixed in 7.9.2.
- Fixed in 6.8.13 (released Oct 22, 2020, the day of disclosure) and 7.9.2 (released Sep 24, 2020, 28 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2020-7019](https://cve.now/CVE-2020-7019): In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security.

- Severity: Unrated
- Published: Aug 18, 2020
- Affected: from 7.0.0, fixed in 7.9.0; fixed in 6.8.12.
- Fixed in 6.8.12 (released Aug 18, 2020, the day of disclosure) and 7.9.0 (released Aug 18, 2020, the day of disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2020-7014](https://cve.now/CVE-2020-7014): The fix for CVE-2020-7009 was found to be incomplete.

- Severity: Unrated
- Published: Jun 3, 2020
- Affected: from 6.7.0, fixed in 6.8.8; from 7.0.0, fixed in 7.6.2.
- Fixed in 6.8.8 (released Mar 30, 2020, 65 days before disclosure) and 7.6.2 (released Mar 30, 2020, 65 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2020-7009](https://cve.now/CVE-2020-7009): Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create…

- Severity: Unrated
- Published: Mar 31, 2020
- Affected: from 6.7.0, fixed in 6.8.8; from 7.0.0, fixed in 7.6.2.
- Fixed in 6.8.8 (released Mar 30, 2020, 1 day before disclosure) and 7.6.2 (released Mar 30, 2020, 1 day before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2019-7619](https://cve.now/CVE-2019-7619): Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service.

- Severity: Unrated
- Published: Oct 30, 2019
- Affected: from 6.7.0, fixed in 6.8.4; from 7.0.0, fixed in 7.4.0.
- Fixed in 6.8.4 (released Oct 22, 2019, 8 days before disclosure) and 7.4.0 (released Sep 27, 2019, 33 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2019-7614](https://cve.now/CVE-2019-7614): A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request.

- Severity: Unrated
- Published: Jul 30, 2019
- Affected: fixed in 6.8.2; from 7.0.0, fixed in 7.2.1.
- Fixed in 6.8.2 (released Jul 24, 2019, 6 days before disclosure) and 7.2.1 (released Jul 24, 2019, 6 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2019-7611](https://cve.now/CVE-2019-7611): A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are…

- Severity: Unrated
- Published: Mar 25, 2019
- Affected: fixed in 5.6.15; from 6.0.0, fixed in 6.6.1.
- Fixed in 5.6.15 (released Feb 13, 2019, 40 days before disclosure) and 6.6.1 (released Feb 13, 2019, 40 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2018-17247](https://cve.now/CVE-2018-17247): Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find\_file\_structure API.

- Severity: Unrated
- Published: Dec 20, 2018
- Affected: from 6.5.0, fixed in 6.5.2.
- Fixed in 6.5.2 (released Nov 30, 2018, 20 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2018-17244](https://cve.now/CVE-2018-17244): Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active…

- Severity: Unrated
- Published: Dec 20, 2018
- Affected: from 6.4.0, fixed in 6.4.3.
- Fixed in 6.4.3 (released Oct 31, 2018, 50 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2018-3831](https://cve.now/CVE-2018-3831): Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured…

- Severity: Unrated
- Published: Sep 19, 2018
- Affected: from 5.6.0, fixed in 5.6.12; from 6.0.0, fixed in 6.4.1.
- Fixed in 5.6.12 (released Sep 18, 2018, 1 day before disclosure) and 6.4.1 (released Sep 13, 2018, 6 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2018-3824](https://cve.now/CVE-2018-3824): X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability.

- Severity: Unrated
- Published: Sep 19, 2018
- Affected: fixed in 5.6.9; from 6.0.0, fixed in 6.2.4.
- Fixed in 5.6.9 (released Apr 12, 2018, 160 days before disclosure) and 6.2.4 (released Apr 12, 2018, 160 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2015-4165](https://cve.now/CVE-2015-4165): The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code…

- Severity: Unrated
- Published: Aug 9, 2017
- Affected: fixed in 1.6.0.
- Fixed in 1.6.0 (released Jun 9, 2015, 792 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2015-5531](https://cve.now/CVE-2015-5531): Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors…

- Severity: Unrated
- Published: Aug 17, 2015
- Affected: fixed in 1.6.1.
- Fixed in 1.6.1 (released Jul 16, 2015, 32 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2015-3337](https://cve.now/CVE-2015-3337): Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote…

- Severity: Unrated
- Published: May 1, 2015
- Affected: fixed in 1.4.5; from 1.5.0, fixed in 1.5.2.
- Fixed in 1.4.5 (released Apr 27, 2015, 4 days before disclosure) and 1.5.2 (released Apr 27, 2015, 4 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2015-1427](https://cve.now/CVE-2015-1427): The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection me

- Severity: Critical 9.8 · KEV
- Published: Feb 17, 2015
- Affected: fixed in 1.3.8; from 1.4.0, fixed in 1.4.3.
- Fixed in 1.3.8 (released Feb 11, 2015, 6 days before disclosure) and 1.4.3 (released Feb 11, 2015, 6 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2014-6439](https://cve.now/CVE-2014-6439): Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject…

- Severity: Unrated
- Published: Oct 10, 2014
- Affected: fixed in 1.4.0.Beta1.
- Fixed in 1.4.0.Beta1 (released Oct 1, 2014, 9 days before disclosure).
- The latest release, 9.5.6, is not affected.

### [CVE-2014-3120](https://cve.now/CVE-2014-3120): The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL exp

- Severity: High 8.1 · KEV
- Published: Jul 28, 2014
- Affected: fixed in 1.4.0.Beta1.
- Fixed in 1.4.0.Beta1 (released Oct 1, 2014, 65 days after disclosure).
- The latest release, 9.5.6, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.elasticsearch:elasticsearch
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.