Medium severity5.9NVD Advisory· Published Dec 20, 2018· Updated Jun 17, 2026
CVE-2018-17247
CVE-2018-17247
Description
Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.elasticsearch:elasticsearchMaven | >= 6.5.0, < 6.5.2 | 6.5.2 |
Affected products
2- Range: 6.5.0 and 6.5.1
Patches
Vulnerability mechanics
References
5- www.securityfocus.com/bid/106294nvdThird Party AdvisoryVDB EntryWEB
- discuss.elastic.co/t/elastic-stack-6-5-2-security-update/159594nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-ccmr-qj26-845gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-17247ghsaADVISORY
- www.elastic.co/community/securitynvdVendor AdvisoryWEB
News mentions
0No linked articles in our index yet.