CVE-2015-5377

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 14.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-03-06 · updated 2026-06-17
Weakness: CWE-74

Description

Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability

Affected products

Elasticsearch: before 1.6.1 — fixed in 1.6.1

How to fix

Upgrade to a fixed version: Elasticsearch 1.6.1. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/75938
http://www.zerodayinitiative.com/advisories/ZDI-15-365/
https://discuss.elastic.co/t/elasticsearch-remote-code-execution-cve-2015-5377/25736
https://github.com/elastic/elasticsearch/commit/bf3052d14c874aead7da8855c5fcadf5428a43f2
http://www.securityfocus.com/bid/75938
http://www.zerodayinitiative.com/advisories/ZDI-15-365/
https://discuss.elastic.co/t/elasticsearch-remote-code-execution-cve-2015-5377/25736
https://github.com/elastic/elasticsearch/commit/bf3052d14c874aead7da8855c5fcadf5428a43f2

Get alerted when CVE-2015-5377 or the next vulnerability affects your stack