ElasticSearch <1.6.1 - Local File Inclusion

披露于 2015/08/17 · 更新于 2025/08/04

CVSS 评分5.0/ 10.0

EPSS 概率84.2%百分位 99.3%

漏洞描述

ElasticSearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

RELATED INTELLIGENCE

与 ElasticSearch 相关的其他公开漏洞。

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
elasticsearch ElasticSearch Information Disclosure ElasticSearch	低危	—	—	PoCEXP	2024/01/15
elasticsearch_default_loginRCE ElasticSearch - Default Login ElasticSearch	高危	—	—	PoCEXP	2023/10/20
CVE-2021-44228 Elasticsearch 5 - Remote Code Execution (Apache Log4j) ElasticSearch	严重	10.0	94.4%	PoCEXP	2021/12/10
CVE-2021-22145 Elasticsearch 7.10.0-7.13.3 - Information Disclosure ElasticSearch	中危	6.5	61.1%	PoCEXP	2021/07/21
CVE-2015-3337 Elasticsearch - Local File Inclusion ElasticSearch	中危	4.3	90.7%	PoCEXP	2015/05/01
CVE-2015-1427RCE ElasticSearch - Remote Code Execution ElasticSearch	高危	7.5	93.7%	PoCEXP	2015/02/17