PT-2018-16218 · Elastic · X-Pack Machine Learning

Publicado 2018-09-19 · Atualizado 2022-05-13 · CVE-2018-3824

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions X-Pack Machine Learning versions prior to 6.2.4 X-Pack Machine Learning versions prior to 5.6.9

Description A cross-site scripting (XSS) issue was found. If an attacker can inject data into an index with a running ML job, they could obtain sensitive information or perform actions on behalf of another ML user when that user views the ML job results.

Recommendations For versions prior to 6.2.4, update to version 6.2.4 or later. For versions prior to 5.6.9, update to version 5.6.9 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-3824

GHSA-MJPC-QX7H-R8C9

Produtos afetados

X-Pack Machine Learning

Referências · 5

• https://osv.dev/vulnerability/CVE-2018-3824 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-3824 · Nota de Segurança
• https://elastic.co/community/security · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mjpc-qx7h-r8c9 · Aviso do Fabricante
• https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422 · Aviso do Fabricante