CVE-2014-3120
Elasticsearch Remote Code Execution Vulnerability
- Published
- Jul 28, 2014
- Updated
- Oct 22, 2025
- Assigning CNA
- mitre
- Evidence observed
- May 15, 2014
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NHigh · next 30 days
- Percentile
- 99.8%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Sources
6Step-by-step lab guide demonstrating CVE-2014-3120 exploitation against Elasticsearch 1.1.1, covering vulnerability analysis, RCE via MVEL scripting, and post-exploitation in a Docker environment.
- ElasticSearch-CVE-2014-3120Exploit
Python-based proof-of-concept exploit for ElasticSearch CVE-2014-3120 remote code execution vulnerability. Scans hosts and reports vulnerable instances via HTTP API.
- es_injectExploit
Proof-of-concept exploit for CVE-2014-3120 Elasticsearch remote code execution, enabling file read and append on the host system via browser-based execution.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.