CVE-2015-1427

Elasticsearch's Groovy scripting engine allowed remote attackers to bypass sandbox protections and execute arbitrary shell commands.

The Groovy scripting engine in Elasticsearch lacked proper sandboxing, enabling remote code execution. DIB organizations must ensure Elasticsearch is patched and sandboxed to prevent attackers from executing arbitrary commands on their infrastructure.

Shame score — A known vulnerability in a widely used search engine allowed remote code execution, indicating a failure to adequately secure a critical component.