Skip to content
Exploit Radar Choose my productsProducts My radar
English

Products › Brands

Brand

Elastic: actively exploited vulnerabilities

3 vulnerabilities in Elastic products (Elasticsearch, Kibana) are in CISA’s catalog of exploited vulnerabilities. Last added: March 25, 2022.

By category

Add just one Elastic category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

  • Elasticsearch 2 vulnerabilities · Business apps and data
  • Kibana 1 vulnerability · Business apps and data

Name used by CISA: Elastic. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Elastic list.

  1. Rank 1Elastic Kibana

    CVE-2019-7609

    CVE from 2019, added in 2022

    Kibana Arbitrary Code Execution

    Added more than a year ago: ranked by severity.

    Added
    Jan 10, 2022
    CISA deadline
    181 days
    CVSS severity
    10.0 (critical)

  2. Rank 2Elastic Elasticsearch

    CVE-2015-1427

    CVE from 2015, added in 2022

    Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Mar 25, 2022
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  3. Rank 3Elastic Elasticsearch

    CVE-2014-3120

    CVE from 2014, added in 2022

    Elasticsearch Remote Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Mar 25, 2022
    CISA deadline
    21 days
    CVSS severity
    8.1 (high)

Follow and verify

Indicative classification, based on the vendor and product names given by CISA. How products are classified.