{"vulnerability": "cve-2015-5531", "sightings": [{"uuid": "60c00f72-ddc3-4e85-9ba8-d48be64be8f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:42.000000Z"}, {"uuid": "f8d3ebfc-8c37-4c63-8711-e43699fa16de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:41.000000Z"}, {"uuid": "ec17518f-eed9-47a5-9731-80b329a529c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_traversal.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "fb6cb841-71dc-4b43-9566-af328e7a6844", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mt2k5yvt3t2n", "content": "~Spiderlabs~\nRAVEN tool enables bulk data exfiltration and resilient persistence via rogue users, API keys, and Watcher schedules on Elasticsearch.\n-\nIOCs: CVE-2015-5531, RAVEN\n-\n#DataExfil #Elasticsearch #ThreatIntel", "creation_timestamp": "2026-08-14T16:08:38.610723Z"}, {"uuid": "ebcff1db-8bb8-40bd-a8b5-d08f66198a7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3msggfxthtg2k", "content": "~Spiderlabs~\nRAVEN framework exploits six Elasticsearch CVEs including root-level RCE via MVEL/Groovy script injection and arbitrary file reads via directory traversal.\n-\nIOCs: CVE-2014-3120, CVE-2015-1427, CVE-2015-5531\n-\n...", "creation_timestamp": "2026-08-06T16:08:31.533162Z"}, {"uuid": "fd1b9a3b-603d-4c9f-93d5-53cbd74e4747", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "Telegram/IBDLQiEWHO72tUJ2Ylqd3zBHJI3jkAPrj_4aeIoADYB6Hgg", "content": "", "creation_timestamp": "2026-08-27T12:00:10.428410Z"}, {"uuid": "4a8387e3-f7a1-4b4e-96e7-ba4aea7d6da3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "Telegram/IBDLQiEWHO72tUJ2Ylqd3zBHJI3jkAPrj_4aeIoADYB6Hgg", "content": "", "creation_timestamp": "2026-08-28T00:00:53.170594Z"}, {"uuid": "613c210b-1ef6-4afd-8191-c132fff2a017", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "published-proof-of-concept", "source": "Telegram/IBDLQiEWHO72tUJ2Ylqd3zBHJI3jkAPrj_4aeIoADYB6Hgg", "content": "", "creation_timestamp": "2026-08-29T00:00:16.183591Z"}]}