Riskcovery

CVE-2018-17247

State
Published
Severity
Not scored
Published
Dec 20, 2018
Updated
Aug 5, 2024
Reserved
Sep 20, 2018

Read the record on cve.org

Description

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-611 Improper Restriction of XML External Entity Reference ('XXE')

Affected Products

ProductVersions
ElasticsearchElastic
  • 6.5.0 and 6.5.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.