{"id":"CVE-2015-3337","aliases":[],"url":"https://o3.security/vulnerability/CVE-2015-3337","summary":"Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch","details":"Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.","published":"2022-05-17T04:12:25Z","modified":"2024-12-07T05:39:54.158518Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":5,"affectedPackages":[{"ecosystem":"Maven","name":"org.elasticsearch:elasticsearch","fixedVersion":"1.4.5"},{"ecosystem":"Maven","name":"org.elasticsearch:elasticsearch","fixedVersion":"1.5.2"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3337"},{"type":"WEB","url":"https://www.elastic.co/community/security"},{"type":"WEB","url":"https://www.exploit-db.com/exploits/37054"},{"type":"WEB","url":"http://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html"},{"type":"WEB","url":"http://www.debian.org/security/2015/dsa-3241"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-07T05:39:54.158518Z"}}