CVE-2018-17247 | BDVDB-2026-110729 Detail

Description#

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12018-12-20Record published in the CVE List.
2. Version 22024-08-05Most recent update recorded in the CVE List.