CVE-2014-3120 Elasticsearch
| Affected software | Elasticsearch |
|---|---|
| Severity | 8.1 High CVSS 3.1 3 scores |
| Fixed in | 1.4.0.Beta1 |
| Weakness | Improper access control (CWE-284) |
| Published | 28 Jul 2014 |
| Updated | 29 Sep 2026 |
Description
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-25 · remediation due 2022-04-15 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 2 citations · honeypot sightings · 4 exploits · earliest 2022-03-25.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: partial.
- Indexed PoC 7 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2014-05-13.
- EPSS 89% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2014-3120 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 112 days | 2023-11-29 to 2026-10-23 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2022-03-25 |
| Reported exploitation | greynoise.io | /blog/coordinated-cloud-based-scanning-operation-targets-75-known-exposure-points | 2025-05-27 |
| Exploit reference | VulnCheck XDB 3bd602f1502c | Exploit type: initial-access | 2014-07-07 |
| Exploit reference | VulnCheck XDB d53ab847ab08 | Exploit type: initial-access | 2024-10-22 |
| Exploit reference | VulnCheck XDB ca3014ea9caf | Exploit type: initial-access | 2026-05-31 |
| Exploit reference | VulnCheck XDB 8647a9c92f51 | Exploit type: initial-access | 2026-10-08 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | POC Code to exploite CVE-2014-3120 | 6 | 2014-07-07 |
| GitHub PoC | Vulhub elasticsearch/CVE-2014-3120: Elasticsearch MVEL Dynamic Script RCE (CVE-2014-3120), run with Isoloom | 2026-10-08 | |
| Exploit-DB | ElasticSearch Dynamic Script - Arbitrary Java Execution (Metasploit) | 2014-05-30 | |
| Exploit-DB | ElasticSearch - Remote Code Execution | 2014-05-15 | |
| GitHub PoC | Demonstration of CVE-2014-3120 | 2014-05-13 | |
| Metasploit | ElasticSearch Dynamic Script Arbitrary Java Execution (excellent rank) | ||
| Nuclei | ElasticSearch v1.1.1/1.2 RCE |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process, Filesystem
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule, ARMR Filesystem Write, ARMR Filesystem Read. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule, ARMR Filesystem Write, ARMR Filesystem Read
Unauthenticated MVEL script injection via _search. The Process rule (with /bin/* and /usr/* listed) blocks the Runtime.exec PoCs; filesystem read and write rules on the named paths block the java.io reads, appends and the Metasploit JAR drop. A script that reads data directly in Java, outside the protected paths, is not stopped.
How to mitigate CVE-2014-3120
Upgrade Elasticsearch to 1.4.0.Beta1 or later. Until you can, Waratek RASP blocks exploitation with its process and filesystem rules. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
8.1 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
3 metrics
CVSS
8.1 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 8.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
NVD | Primary | published |
| CVSS 3.1 | 8.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
CISA-ADP | Secondary | |
| CVSS 2.0 | 6.8 | none | AV:N/AC:M/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.elasticsearch:elasticsearch |
0 | 1.4.0.Beta1 |
unbounded |
Products and versions
2 products, 2 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | elastic | elasticsearch | generic | ＜ 1.2.0 |
| osv | org.elasticsearch | elasticsearch | generic | ＜ 1.4.0 |
References
Timeline
Timeline
| Published | 2014-07-28 | By the CVE Program. |
|---|---|---|
| Added to CISA KEV | 2022-03-25 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: earliest evidence | 2022-03-25 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Last VRT activity | 2026-09-29 | Most recent commit touching this CVE's classification, patch or rule file. |
| VulnCheck KEV: latest evidence | 2026-10-23 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |