CVE-2018-3824: X-Pack Machine Learning cross-site scripting via injected index data

Summary

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 contain a cross-site scripting (XSS) flaw, tracked as CVE-2018-3824 and classified as CWE-79. An attacker who can inject data into an index with a running ML job can affect another user who views that job's results, potentially obtaining sensitive information or performing destructive actions as that user.

Mitigation

The source links Elastic's security update for Elastic Stack 6.2.4 and 5.6.9 (https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422), which indicates the fixed versions, but the source text itself does not describe the fix in detail. Upgrade to 6.2.4 or 5.6.9 or later.

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online