Elasticsearch Groovy Script RCE - security vulnerability (solution)

PROBLEM

The version of Elasticsearch used in the MiContact Center Business system is affected by a remote code vulnerability.  A remote unauthenticated attacker, using a specially crafted request, can escape the sandbox and execute arbitrary Java code.  A successful attack could allow the user to gain a remote shell or manipulate files on the server. 

RESOLUTION

Add a firewall rule to block incomming traffic to the MiContact Center Business server on port 9200. 

APPLIES TO

MiCC 8.0 or newer