{"vulnerability": "cve-2014-3120", "sightings": [{"uuid": "562e80d0-ee40-4430-8edb-afb7f2aa8fb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "MISP/5444a4b6-a7b8-41f0-8f49-45c7950d210b", "content": "", "creation_timestamp": "2014-10-20T06:04:12.000000Z"}, {"uuid": "4694554c-a1c1-42fa-bd8c-5b50c52c14c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "MISP/5ef48179-b724-4792-abb9-4491ac13a7a7", "content": "", "creation_timestamp": "2020-06-26T06:08:57.000000Z"}, {"uuid": "7a62cdc6-1537-493f-bc0b-a62bb3ab9a90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "MISP/1e58e188-7443-497f-a296-717763199581", "content": "", "creation_timestamp": "2020-10-09T15:40:34.000000Z"}, {"uuid": "41c3cd21-73ae-41c7-a077-f64bb6d43a31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:03.000000Z"}, {"uuid": "4bc8f2e0-3023-4065-9f7b-5bb87f6ebfe6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971402", "content": "", "creation_timestamp": "2024-12-24T20:28:48.585842Z"}, {"uuid": "41ff892d-b526-4baf-9fab-31dc281bb529", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:41.000000Z"}, {"uuid": "072536db-ffb0-47d8-9d76-e19a17a8daec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:06.000000Z"}, {"uuid": "9d8619b0-712c-4001-820d-bf453d5a308f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:28.000000Z"}, {"uuid": "f1cd5441-2f74-4ac8-b95c-8b080b60d882", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-26)", "content": "", "creation_timestamp": "2025-04-26T00:00:00.000000Z"}, {"uuid": "f0c77297-48bf-4e28-89ab-68f49af465b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-25)", "content": "", "creation_timestamp": "2025-05-25T00:00:00.000000Z"}, {"uuid": "d4a9d594-40b7-43cc-ae9c-8f565ca324e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-07)", "content": "", "creation_timestamp": "2025-05-07T00:00:00.000000Z"}, {"uuid": "d1c20052-4703-474d-9220-b2dbbf76e8cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-07)", "content": "", "creation_timestamp": "2025-05-07T00:00:00.000000Z"}, {"uuid": "0e88749f-3e93-4a5c-8da4-e2e47ba7d5ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-08)", "content": "", "creation_timestamp": "2025-05-08T00:00:00.000000Z"}, {"uuid": "bcb131c4-4ed7-4242-b0e0-b8b7dde3dc4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-05-12)", "content": "", "creation_timestamp": "2025-05-12T00:00:00.000000Z"}, {"uuid": "1d08c050-eafa-45a6-b99a-ad4139e9bdfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:01:33.000000Z"}, {"uuid": "e4036770-1504-4901-936b-857dce5d8f8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/elasticsearch/script_mvel_rce.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "b02cc018-4e6a-4732-8303-80684ca5e34d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2014-3120", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4bd63a31-334e-4f1f-b2cb-b0bb1bc0b376", "content": "", "creation_timestamp": "2026-02-02T12:28:05.271641Z"}, {"uuid": "bc99d9dd-51bf-4953-a040-14f06cb1599d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "https://gist.github.com/aw-junaid/6ba7bcfb795f6a9e31d2f07c98443ebb", "content": "", "creation_timestamp": "2026-04-05T07:50:38.000000Z"}, {"uuid": "7bd8721e-3b98-4a9d-b624-d7c35c34bd08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2014-3120", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/33370", "content": "", "creation_timestamp": "2014-05-15T00:00:00.000000Z"}, {"uuid": "494e77f9-a0d0-4928-8a1a-fce9a0b9be59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2014-3120", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/33588", "content": "", "creation_timestamp": "2014-05-30T00:00:00.000000Z"}, {"uuid": "7eed0d37-77ae-466d-85ba-3f991f89ce4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "Telegram/e6Y0MWL-lvm12S3Q5KzUZVq97DAu2tYBuSvFZcuk_8pSSgf-", "content": "", "creation_timestamp": "2025-02-14T10:00:30.000000Z"}, {"uuid": "bc340e2d-a18b-4115-b545-f2ac722eba4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "https://t.me/arpsyndicate/1886", "content": "#ExploitObserverAlert\n\nCVE-2014-3120\n\nDESCRIPTION: Exploit Observer has 80 entries related to CVE-2014-3120. The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search.  NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.\n\nFIRST-EPSS: 0.530130000\nNVD-IS: 6.4\nNVD-ES: 8.6", "creation_timestamp": "2023-12-18T01:56:04.000000Z"}, {"uuid": "dced9bbd-c533-4393-abbe-981982439c0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "https://t.me/arpsyndicate/1477", "content": "#ExploitObserverAlert\n\nCVE-2014-3120\n\nDESCRIPTION: Exploit Observer has 79 entries related to CVE-2014-3120. The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search.  NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.\n\nFIRST-EPSS: 0.530130000\nNVD-IS: 6.4\nNVD-ES: 8.6", "creation_timestamp": "2023-12-06T11:24:15.000000Z"}, {"uuid": "6179e4dc-6382-47eb-bd04-f1f71ab00f42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/802", "content": "Python3", "creation_timestamp": "2023-08-02T20:05:43.000000Z"}, {"uuid": "a1fe6b14-69ef-48be-beae-f11108dc660a", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6da5432a-eaa5-4714-b035-ba755aac6e61", "content": "", "creation_timestamp": "2026-06-19T12:47:24.475887Z"}, {"uuid": "cabf4925-09b1-49bc-bb7d-cd6dea0aa127", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/980088a2-6067-4444-a062-32aabfd6753f", "content": "", "creation_timestamp": "2026-06-23T14:05:09.301946Z"}, {"uuid": "bacf78f4-9088-4c74-9be8-655ce425134e", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2014-3120", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b3955383-3a42-422e-99b3-19ba76d6a92e", "content": "", "creation_timestamp": "2026-06-30T11:38:55.358694Z"}, {"uuid": "61fbed29-0616-4966-bb34-b29401684ac2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3msggfxthtg2k", "content": "~Spiderlabs~\nRAVEN framework exploits six Elasticsearch CVEs including root-level RCE via MVEL/Groovy script injection and arbitrary file reads via directory traversal.\n-\nIOCs: CVE-2014-3120, CVE-2015-1427, CVE-2015-5531\n-\n...", "creation_timestamp": "2026-08-06T16:08:31.443634Z"}, {"uuid": "d341dda9-0027-4f4c-867f-accbc12717f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "MISP/5ef48179-b724-4792-abb9-4491ac13a7a7", "content": "", "creation_timestamp": "2026-08-25T00:15:02.909178Z"}, {"uuid": "6544e349-df44-4b45-bbe7-4fab9258d6b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "MISP/5ef48179-b724-4792-abb9-4491ac13a7a7", "content": "", "creation_timestamp": "2026-08-24T12:15:02.644468Z"}, {"uuid": "a488fc20-2e4f-4043-8173-0c3148d19815", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-3120", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/elasticsearch/script_mvel_rce.rb", "content": "{\"aliases\": [], \"arch\": \"java\", \"author\": [\"Alex Brasetvik\", \"Bouke van der Bijl\", \"juan vazquez \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a remote command execution (RCE) vulnerability in ElasticSearch,\\n          exploitable by default on ElasticSearch prior to 1.2.0. The bug is found in the\\n          REST API, which does not require authentication, where the search\\n          function allows dynamic scripts execution. It can be used for remote attackers\\n          to execute arbitrary Java code. This module has been tested successfully on\\n          ElasticSearch 1.1.1 on Ubuntu Server 12.04 and Windows XP SP3.\", \"disclosure_date\": \"2013-12-09\", \"fullname\": \"exploit/multi/elasticsearch/script_mvel_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:09 +0000\", \"name\": \"ElasticSearch Dynamic Script Arbitrary Java Execution\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/elasticsearch/script_mvel_rce.rb\", \"platform\": \"Java\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/elasticsearch/script_mvel_rce\", \"references\": [\"CVE-2014-3120\", \"OSVDB-106949\", \"EDB-33370\", \"URL-http://bouk.co/blog/elasticsearch-rce/\", \"URL-https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch\"], \"rport\": 9200, \"session_types\": false, \"targets\": [\"ElasticSearch 1.1.1 / Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:38.415219Z"}]}