# Spring4Shell ::Spring Framework Remote Code Execution Vulnerability

**URL:** <https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/302396>\
**Category:** Elasticsearch\
**Created:** [April 14, 2022, 7:07am UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/302396 "2022-04-14T07:07:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sagarika\_Mahalik](https://avatars.discourse-cdn.com/v4/letter/s/eb8c5e/32.png) [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\
**Post date:** [April 14, 2022, 7:07am UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/302396/1 "2022-04-14T07:07:08Z")

</div>

Hello,

We are using Elasticsearch 7.16.3 and Elasticsearch 7.15.1.

1. Can you let us know which java version both the Elasticsearch versions are using?

2. Please let us know, whether ES is affected any way by the reported spring shell vulnerability.

Please suggest, whether we need to take any steps from our end for mitigating the same

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 14, 2022, 7:56am UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/302396/2 "2022-04-14T07:56:08Z")

</div>

1. It's printed in the logs
2. No.

---

<div class="post-metadata">

**Author:** ![Sagarika\_Mahalik](https://avatars.discourse-cdn.com/v4/letter/s/eb8c5e/32.png) [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\
**Post date:** [April 14, 2022, 4:10pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/302396/3 "2022-04-14T16:10:40Z")

</div>

1. whether ES is affected any way by the reported spring shell vulnerability:  
Can I get an explanation for that why it is not affected?

---

<div class="post-metadata">

**Author:** ![Sagarika\_Mahalik](https://avatars.discourse-cdn.com/v4/letter/s/eb8c5e/32.png) [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\
**Post date:** [April 14, 2022, 4:24pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/302396/4 "2022-04-14T16:24:54Z")

</div>

I checked the java version we are using for ES 7.16.3 is Java 17. Also, we use Elasticsearch-rest-client, Elasticsearch-rest-high-level-client and spring data too. Will these affected by the Spring4Shell ::Spring Framework Remote Code Execution Vulnerability?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 15, 2022, 12:20pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/302396/5 "2022-04-15T12:20:05Z")

</div>

Elasticsearch does not use Spring. So it can't be affected by it.

If you are using Spring, then, that's another story but this is something you should check on the Spring forums IMO.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2022, 12:20pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/302396/6 "2022-05-13T12:20:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.