CVE-2018-17247

MEDIUM

Elasticsearch Security 6.5.0-6.5.1 - Info Disclosure

Title source: llm
STIX 2.1

Description

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/106294
Vendor Advisory x_refsource_confirm
https://www.elastic.co/community/security

Scores

CVSS v3 5.9
EPSS 0.0028
EPSS Percentile 51.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-611
Status published
Products (3)
elastic/elasticsearch 6.5.0
elastic/elasticsearch 6.5.1
org.elasticsearch/elasticsearch 6.5.0 - 6.5.2Maven
Published Dec 20, 2018
Tracked Since Feb 18, 2026