GitHub Advisoryadvisory · Maven

GHSA-mjpc-qx7h-r8c9 Elasticsearch subject to cross site scripting

MEDIUM Published 2022-05-13 Modified 2024-01-08 Official page ↗
Aliases
CVE-2018-3824
Ecosystem
Maven
Packages
org.elasticsearch:elasticsearch
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-01-08

Affected packages

• Maven org.elasticsearch:elasticsearch: < 5.6.9 → fixed in 5.6.9 • Maven org.elasticsearch:elasticsearch: >= 6.0.0, < 6.2.4 → fixed in 6.2.4

Description

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of that other ML user.

Related

Alias · CVE (1)

  • CVE-2018-3824 X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References