Cross-Site Scripting Vulnerability in Elasticsearch by Elastic
CVE-2014-6439

Currently unrated

Key Information:

Vendor: Elastic
Status: Elasticsearch
Vendor: CVE Published:; 10 October 2014

What is CVE-2014-6439?

A cross-site scripting (XSS) vulnerability exists within the Cross-Origin Resource Sharing (CORS) functionality in Elasticsearch, allowing remote attackers to inject arbitrary web scripts or HTML. This vulnerability is present in versions prior to 1.4.0.Beta1. Attackers can exploit this flaw through unspecified vectors, potentially leading to unauthorized access and manipulation of web applications that interact with the affected Elasticsearch versions. Users are advised to upgrade to secure versions to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch