CVE-2018-3824
Elastic Elasticsearch X-Pack Machine Learning
MEDIUM 6.1
At a glance
- Source
- NVD
- EPSS
- EPSS 0.89 % · percentile 59 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- elastic
- NVD status
- Modified
Description
X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of that other ML user.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-mjpc-qx7h-r8c9 — Elasticsearch subject to cross site scripting
European references
- ENISA EUVD · EUVD-2022-4583
- GCVE · GCVE-0-2018-3824
CERT-FR advisories
- CERTFR-2025-AVI-0855 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0661 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:elastic:elasticsearch_x-pack:*:*:*:*:*:*:*:*< 5.6.9cpe:2.3:a:elastic:elasticsearch_x-pack:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.2.4cpe:2.3:a:elastic:kibana_x-pack:*:*:*:*:*:*:*:*< 5.6.9cpe:2.3:a:elastic:kibana_x-pack:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.2.4cpe:2.3:a:elastic:logstash_x-pack:*:*:*:*:*:*:*:*< 5.6.9cpe:2.3:a:elastic:logstash_x-pack:*:*:*:*:*:*:*:*≥ 6.1.0 < 6.2.4
Affected products
| Product | Versions |
|---|---|
| Elastic · Elasticsearch X-Pack Machine Learning | affected before 6.2.4 and 5.6.9 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |