CyberRota Analysis
AI-GeneratedThe Elasticsearch machine learning component is vulnerable to remote code execution due to deserialization of untrusted data, allowing attackers to execute arbitrary logic through specially crafted model artifacts. This vulnerability requires an authenticated user with sufficient privileges to deploy trained models, potentially exposing the system to extensive unauthorized actions. Organizations using Elasticsearch with machine learning capabilities should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.
Related CVEs
Other vulnerabilities affecting the same vendor(s)