CVE-2018-3824
Last modified
CVE-2018-3824 is a vulnerability of currently unknown severity. X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of that other ML user.. EPSS estimates a 0.87% chance of exploitation in the next 30 days.
Description
X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of that other ML user.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Elasticsearch X-Pack | < 5.6.9 |
| Elastic | Elasticsearch X-Pack | >= 6.0.0, < 6.2.4 |
| Elastic | Kibana X-Pack | < 5.6.9 |
| Elastic | Kibana X-Pack | >= 6.0.0, < 6.2.4 |
| Elastic | Logstash X-Pack | < 5.6.9 |
| Elastic | Logstash X-Pack | >= 6.1.0, < 6.2.4 |
References
- https://www.elastic.co/community/securityVendor Advisory
- https://www.elastic.co/community/securityVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-3824?
How severe is CVE-2018-3824?
How do I fix CVE-2018-3824?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-3818Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site sc…
- CVE-2018-3819The fix in Kibana for ESA-2017-23 was incomplete. With X-Pac…
- CVE-2018-3820Kibana versions after 6.1.0 and before 6.1.3 had a cross-sit…6.1
- CVE-2018-3821Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a…6.1
- CVE-2018-3822X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnera…9.8
- CVE-2018-3823X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had …5.4
- CVE-2018-3825In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a …
- CVE-2018-3826In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure …
- CVE-2018-3827A sensitive data disclosure flaw was found in the Elasticsea…8.1
- CVE-2018-3828Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 conta…
- CVE-2018-3829In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it…5.3
- CVE-2018-3830Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (X…6.1
Are you affected by CVE-2018-3824?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST