1. Home
  2. Vulnerabilities
  3. CVE-2018-3824

CVE-2018-3824

CVSS v3.0 6.1 (Medium)
61% Progress
CVSS v2.0 4.3 (Medium)
43% Progress
EPSS 0.08 % (37th)
0.08% Progress
Affected Products 3
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of that other ML user.

Weaknesses
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE Status
PUBLISHED
CNA
Elastic
Published Date
2018-09-19 19:29:00
(6 years ago)
Updated Date
2019-10-09 23:40:40
(5 years ago)

Affected Products

Elastic

Configuration #1

    CPE23 From Up To
  Elasticsearch X-pack prior 5.6.9 version cpe:2.3:a:elastic:elasticsearch_x-pack < 5.6.9
  Elasticsearch X-pack from 6.0.0 version and prior 6.2.4 version cpe:2.3:a:elastic:elasticsearch_x-pack >= 6.0.0 < 6.2.4

Configuration #2

    CPE23 From Up To
  Elastic Kibana X-pack prior 5.6.9 version cpe:2.3:a:elastic:kibana_x-pack < 5.6.9
  Elastic Kibana X-pack from 6.0.0 version and prior 6.2.4 version cpe:2.3:a:elastic:kibana_x-pack >= 6.0.0 < 6.2.4

Configuration #3

    CPE23 From Up To
  Elastic Logstash X-pack prior 5.6.9 version cpe:2.3:a:elastic:logstash_x-pack < 5.6.9
  Elastic Logstash X-pack from 6.1.0 version and prior 6.2.4 version cpe:2.3:a:elastic:logstash_x-pack >= 6.1.0 < 6.2.4