{"id":"CVE-2014-6439","published":"2014-10-10T01:00:00Z","modified":"2024-08-06T12:17:23Z","title":"Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote…","vendor":null,"product":null,"tier":"tail","description":{"text":"Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02023,"percentile":0.80833,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.elasticsearch.org/blog/elasticsearch-1-4-0-beta-released/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/archive/1/533602/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.securityfocus.com/bid/70233","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://packetstormsecurity.com/files/128556/Elasticsearch-1.3.x-CORS-Issue.html","tags":["x_refsource_MISC"]},{"url":"https://www.elastic.co/community/security/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":21.2,"factors":[{"name":"EPSS percentile","points":16.17},{"name":"Public exploit code","points":5.0}]},"affected":[{"ecosystem":"Maven","package":"org.elasticsearch:elasticsearch","vulnerableRanges":["<1.4.0.Beta1"],"patched":["1.4.0.Beta1"],"from":["GHSA-8699-m855-cwqf"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3121","exploited":false,"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/128556/Elasticsearch-1.3.x-CORS-Issue.html"]}