There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If
    an attacker is able to inject data into an index that has a ML job running against it, then when another
    user views the results of the ML job it could allow the attacker to obtain sensitive information from or
    perform destructive actions on behalf of that other ML user. (CVE-2018-3824)

X-Pack Machine Learning 6.2.4 和 5.6.9 之前的版本存在一個跨網站指令碼 (XSS) 弱點。如果攻擊者可以將資料插入到具有針對其執行之 ML 工作的索引中，則當另一位使用者檢視 ML 工作的結果時，可讓攻擊者從其他 ML 使用者取得敏感資訊，或代表其他 ML 使用者執行破壞性的動作。

X-Pack Machine Learning 6.2.4 和 5.6.9 之前的版本存在一个跨站脚本 (XSS) 漏洞。如果攻击者可以将数据注入具有针对其执行之 ML 作业的索引中，则当另一位用户查看 ML 作业的结果时，可让攻击者从其他 ML 用户处获得敏感信息，或代表其他 ML 用户执行破坏性操作。

バージョン6.2.4および5.6.9より前のX-Pack Machine Learningには、クロスサイトスクリプティング（XSS）の脆弱性があります。攻撃者が、MLジョブを実行中のインデックスにデータを挿入することができた場合、そのMLジョブの結果を他のユーザーが閲覧するとき、攻撃者がそのMLユーザーから秘密情報を取得したり、そのMLユーザーに代わって破壊的な操作を実行したりする可能性があります。

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross- site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of that other ML user.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
432482	SCA: security update for org.elasticsearch:elasticsearch (GHSA-mjpc-qx7h-r8c9)	Tenable Cloud Security	SCA Checks	2025/8/8	2025/8/8	medium
432550	SCA: security update for org.elasticsearch:elasticsearch (GHSA-mjpc-qx7h-r8c9)	Tenable Cloud Security	SCA Checks	2025/8/8	2026/7/2	medium
432482	SCA: security update for org.elasticsearch:elasticsearch (GHSA-mjpc-qx7h-r8c9)	Tenable Self-Hosted Container Security	SCA Checks	2025/8/8	2025/8/8	medium
432550	SCA: security update for org.elasticsearch:elasticsearch (GHSA-mjpc-qx7h-r8c9)	Tenable Self-Hosted Container Security	SCA Checks	2025/8/8	2026/7/2	medium
121357	Kibana ESA-2018-08	Nessus	CGI abuses	2019/1/25	2019/10/31	medium
121357	Kibana ESA-2018-08	Nessus	CGI abuses	2019/1/25	2019/10/31	medium
121357	Kibana ESA-2018-08	Nessus	CGI abuses	2019/1/25	2019/10/31	medium
121357	Kibana ESA-2018-08	Nessus	CGI abuses	2019/1/25	2019/10/31	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium