Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-ccmr-qj26-845g

Опубликовано: 13 мая 2022
Источник: github
Github: Прошло ревью
CVSS3: 5.9

Описание

Improper Restriction of XML External Entity Reference in Elasticsearch

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.

Пакеты

Наименование

org.elasticsearch:elasticsearch

maven
Затронутые версииВерсия исправления

>= 6.5.0, < 6.5.2

6.5.2

EPSS

Процентиль: 52%
0.00294
Низкий

5.9 Medium

CVSS3

Дефекты

CWE-611

Связанные уязвимости

CVSS3: 5.9
ubuntu
около 7 лет назад

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.

CVSS3: 5.9
nvd
около 7 лет назад

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.

CVSS3: 5.9
debian
около 7 лет назад

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in ...

EPSS

Процентиль: 52%
0.00294
Низкий

5.9 Medium

CVSS3

Дефекты

CWE-611