CVE-2018-17247CWE-611

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API

published December 20, 2018

CVSS
—
EPSS
1%
Percentile
72.0
In the wild
Unconfirmed
What it is

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01383 · 72.0th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2018-12-20T22:00Z
EPSS history
Timeline
  • 20 DEC 22:00Z
    Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API
    cvelistv5