Cpnrodzc7

A flaw exists in Elasticsearch. The specific details of the issue are not provided.

The issue is related to insufficient access control in the EjbObjectInputStream class of the Apache TomEE application server. It can be exploited by a remote attacker using a specially crafted serialized object to execute arbitrary code.

The issue is related to the ChangePassword RPC method, which allows remote attackers to conduct XPath injection attacks and read arbitrary text files via a malformed query. This is due to incorrect code generation management. The exploitation of this issue can enable a remote attacker to perform XPath injection attacks and gain read access to text files using a distorted query.

The issue is related to the cliserver implementation, which lacks input data sanitization measures. This allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data. The vulnerability can be exploited by sending specially formed XML data, enabling the execution of arbitrary Java code.