{"vulnerability": "CVE-2015-5531", "sightings": [{"uuid": "60c00f72-ddc3-4e85-9ba8-d48be64be8f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:42.000000Z"}, {"uuid": "f8d3ebfc-8c37-4c63-8711-e43699fa16de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:41.000000Z"}, {"uuid": "ec17518f-eed9-47a5-9731-80b329a529c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_traversal.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "fb6cb841-71dc-4b43-9566-af328e7a6844", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mt2k5yvt3t2n", "content": "~Spiderlabs~\nRAVEN tool enables bulk data exfiltration and resilient persistence via rogue users, API keys, and Watcher schedules on Elasticsearch.\n-\nIOCs: CVE-2015-5531, RAVEN\n-\n#DataExfil #Elasticsearch #ThreatIntel", "creation_timestamp": "2026-08-14T16:08:38.610723Z"}, {"uuid": "ebcff1db-8bb8-40bd-a8b5-d08f66198a7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3msggfxthtg2k", "content": "~Spiderlabs~\nRAVEN framework exploits six Elasticsearch CVEs including root-level RCE via MVEL/Groovy script injection and arbitrary file reads via directory traversal.\n-\nIOCs: CVE-2014-3120, CVE-2015-1427, CVE-2015-5531\n-\n...", "creation_timestamp": "2026-08-06T16:08:31.533162Z"}, {"uuid": "fd1b9a3b-603d-4c9f-93d5-53cbd74e4747", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "Telegram/IBDLQiEWHO72tUJ2Ylqd3zBHJI3jkAPrj_4aeIoADYB6Hgg", "content": "", "creation_timestamp": "2026-08-27T12:00:10.428410Z"}, {"uuid": "4a8387e3-f7a1-4b4e-96e7-ba4aea7d6da3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "Telegram/IBDLQiEWHO72tUJ2Ylqd3zBHJI3jkAPrj_4aeIoADYB6Hgg", "content": "", "creation_timestamp": "2026-08-28T00:00:53.170594Z"}, {"uuid": "613c210b-1ef6-4afd-8191-c132fff2a017", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "published-proof-of-concept", "source": "Telegram/IBDLQiEWHO72tUJ2Ylqd3zBHJI3jkAPrj_4aeIoADYB6Hgg", "content": "", "creation_timestamp": "2026-08-29T00:00:16.183591Z"}, {"uuid": "ea3053c8-fb52-4c83-86b3-24f3e74a21aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-5531", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_traversal.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Benjamin Smith\", \"Pedro Andujar \", \"Jose A. Guasch \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"'This module exploits a directory traversal vulnerability in\\n          ElasticSearch, allowing an attacker to read arbitrary files\\n          with JVM process privileges, through the Snapshot API.'\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/http/elasticsearch_traversal\", \"is_install_path\": true, \"mod_time\": \"2026-04-21 15:18:58 +0000\", \"name\": \"ElasticSearch Snapshot API Directory Traversal\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/auxiliary/scanner/http/elasticsearch_traversal.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/elasticsearch_traversal\", \"references\": [\"CVE-2015-5531\", \"PACKETSTORM-132721\"], \"rport\": 9200, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:31.257788Z"}]}