{"data":{"id":"7c712402-7606-4856-9a7a-da41313ae338","title":"CVE-2018-3824: X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker…","summary":"X-Pack Machine Learning versions before 6.2.4 and 5.6.9 contain a cross-site scripting (XSS) flaw, tracked as CVE-2018-3824 and classified as CWE-79. An attacker who can inject data into an index with a running ML job can affect another user who views that job's results, potentially obtaining sensitive information or performing destructive actions as that user.","solution":"The source links Elastic's security update for Elastic Stack 6.2.4 and 5.6.9 (https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422), which indicates the fixed versions, but the source text itself does not describe the fix in detail. Upgrade to 6.2.4 or 5.6.9 or later.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-3824","publishedAt":"2018-09-19T19:29:00.360Z","cveId":"CVE-2018-3824","cweIds":["CWE-79","CWE-79"],"cvssScore":"4.3","cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["org.elasticsearch:elasticsearch@< 5.6.9 (fixed: 5.6.9)","org.elasticsearch:elasticsearch@>= 6.0.0, < 6.2.4 (fixed: 6.2.4)"],"affectedPackageNames":["org-elasticsearch:elasticsearch"],"affectedPackageRefs":["maven:org-elasticsearch:elasticsearch"],"affectedVendors":[],"affectedVendorsRaw":["X-Pack Machine Learning","Elastic Stack"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"X-Pack Machine Learning cross-site scripting via injected index data","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00891,"epssCheckedAt":"2026-11-04T12:08:33.434Z","kevDateAdded":null,"advisoryAliases":["GHSA-mjpc-qx7h-r8c9"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T04:01:16.019Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:53:05.890Z","capecIds":["CAPEC-198","CAPEC-86"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":null,"name":"org.elasticsearch:elasticsearch","fixedVersion":"6.2.4","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-10-29T21:53:05.737Z"},{"ecosystem":null,"name":"org.elasticsearch:elasticsearch","fixedVersion":"5.6.9","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-10-29T21:53:05.737Z"}]}}