CVE-2014-3120
HighExploitedPublic exploitElasticsearch Improper Access Control vulnerability
Published May 17, 2022 · Updated Oct 22, 2025 · Also known as GHSA-mrfm-jxgf-2h6v
Key Facts
Patch immediately- CVE-2014-3120 is a high-severity vulnerability (CVSS 8.1 v3.1) affecting Elasticsearch, org.elasticsearch:elasticsearch (maven), katello-configure (redhat).
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 25, 2022. Public exploit code is available.
- EPSS estimates a 89% probability of exploitation in the next 30 days.
- Fixed versions are available, including Elasticsearch 1.2.0, katello-configure 0:1.4.5.1-3.el6sam, org.elasticsearch:elasticsearch 1.4.0.Beta1.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS (30-day exploit likelihood)
89%
Higher than 99.7% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2014-3120 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| Industry KEV feed | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| CIRCL KEV | Mar 25, 2022 | Apr 15, 2022 | Not reported |
| ENISA EUVD | Mar 25, 2022 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| ElasticsearchElastic | See advisory | 1.2.0 |
| org.elasticsearch:elasticsearchmaven | See advisory | 1.4.0.Beta1 |
| katello-configureredhat | See advisory | 0:1.4.5.1-3.el6sam |
Patched Releases
Elasticsearch
1.2.0
katello-configure
0:1.4.5.1-3.el6sam
org.elasticsearch:elasticsearch
1.4.0.Beta1
Timeline
Added to CISA KEV
Mar 25, 2022
Added to Industry KEV feed
Mar 25, 2022
Added to CIRCL KEV
Mar 25, 2022
Added to ENISA EUVD
Mar 25, 2022
Publicly disclosed
May 17, 2022
Last updated
Oct 22, 2025
Weakness Type
- CWE-284 Improper Access Control
- CWE-749 Exposed Dangerous Method or Function
References
- advisoryRHSA-2014:1170
- advisoryRHSA-2014:1171
- advisoryRHSA-2014:1186
- advisoryGHSA advisory
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2014-3120
FAQ
Common Questions.
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search.
Affected: Elasticsearch; org.elasticsearch:elasticsearch (maven); katello-configure (redhat). The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 25, 2022.
Yes. It was added on Mar 25, 2022 with a federal remediation due date of Apr 15, 2022.
Public exploit code is available.
Fixed versions are available, including Elasticsearch 1.2.0, katello-configure 0:1.4.5.1-3.el6sam, org.elasticsearch:elasticsearch 1.4.0.Beta1.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2014-3120 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo