CVE-2018-17247

2018-12-2022:00:00

CWE-611

elastic

www.cve.org

5.4 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.1%

JSON

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning’s find_file_structure API. If a policy allowing external network access has been added to Elasticsearch’s Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.

CNA Affected

[
  {
    "product": "Elasticsearch",
    "vendor": "Elastic",
    "versions": [
      {
        "status": "affected",
        "version": "6.5.0 and 6.5.1"
      }
    ]
  }
]