PT-2018-13967 · Elastic · Elasticsearch

Published 2018-12-20 · Updated 2022-05-13 · CVE-2018-17247

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elasticsearch Security versions 6.5.0 and 6.5.1

Description The issue is related to an XXE flaw in Machine Learning's find file structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager, an attacker could send a specially crafted request to leak the content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.

Recommendations For Elasticsearch Security versions 6.5.0 and 6.5.1, consider restricting access to the find file structure API until a patch is available. As a temporary workaround, review and restrict policies allowing external network access in Elasticsearch's Java Security Manager to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-17247

GHSA-CCMR-QJ26-845G

Affected Products

Elasticsearch

References · 7

• https://elastic.co/community/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17247 · Security Note
• https://discuss.elastic.co/t/elastic-stack-6-5-2-security-update/159594 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ccmr-qj26-845g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-17247 · Vendor Advisory
• http://securityfocus.com/bid/106294 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17247 · Note