CVE-2018-3824: falha em Elasticsearch X-Pack Machine Learning
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar Elasticsearch X-Pack Machine Learning+ Monitorar org.elasticsearch:elasticsearch
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.9%
X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of that other ML user.
Produtos afetados
Elastic · Elasticsearch X-Pack Machine LearningCVEs relacionadas — Elasticsearch X-Pack Machine Learning
No mesmo produto, das mais perigosas para as menos.