CVE-2014-3120
Elasticsearch Remote Code Execution Vulnerability
Published Jul 28, 2014 · updated Jun 16, 2026 · elastic elasticsearch
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Timeline
Detection, updates, and resolution for this record.
Jul 28, 2014 · Catalog
Detected
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Mar 25, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 15, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.
Required action
Apply updates per vendor instructions.
CISA due date Apr 15, 2022
Affected
- cpe elastic/elasticsearchversion unspecified
- vendor Elastic Elasticsearchversion unspecified
Sources
- CISA KEVCVE-2014-3120
Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.
cisa.gov - CVE.orgCVE-2014-3120
Official CVE identifier
cve.org - FIRST EPSSCVE-2014-3120
30-day exploitation probability 88.6%
first.org - Exploit Database33370
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database33588
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/elasticsearch/script_mvel_rce
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2014-3120
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does
nvd.nist.gov