CVE-2018-3823

—

CVSS 3.1

5.4 medium

EPSS

<1%p49

Published

Sep 19, 2018 (Sep 19, 2018)

Modified

Jun 17, 2026

Description

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of other ML users viewing the results of the jobs.

Vendors: elastic
Products: elasticsearch x-pack, kibana x-pack, logstash x-pack
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.