ElasticsearchGHSA-mjpc-qx7h-r8c9
Elasticsearch subject to cross site scripting
Medium6.1CVE-2018-3824 · Published May 13, 2022 · updated Feb 16, 2024
X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of that other ML user.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.elasticsearch:elasticsearch Maven | < 5.6.9 | 5.6.9 |
| >= 6.0.0, < 6.2.4 | 6.2.4 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2018-3824
More Elasticsearch advisories
All Elasticsearch| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 142022 | Improper Access Control in Elasticsearch High7.5May 14, 2022 | High7.5 | 1.6.0 |
| May 142022 | Improper Limitation of a Pathname to a Restricted Directory in ElasticsearchMediumMay 14, 2022 | Medium | 1.6.1 |
| May 132022 | Improper Restriction of XML External Entity Reference in ElasticsearchMedium5.9May 13, 2022 | Medium5.9 | 6.5.2 |
| May 132022 | Exposure of Sensitive Information to an Unauthorized Actor in ElasticsearchMedium6.5May 13, 2022 | Medium6.5 | 6.4.3 |
| May 132022 | Exposure of Sensitive Information to an Unauthorized Actor in ElasticsearchHigh8.8May 13, 2022 | High8.8 | 5.6.12+1 more |
| May 132022 | Improper Access Control in ElasticsearchHigh8.1May 13, 2022 | High8.1 | 5.6.15+1 more |