Not rated

CVE-2018-3823 X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability

Description

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of other ML users viewing the results of the jobs.

Affected products and versions

Product	Affected versions	Fixed in
Elasticsearch X-Pack Machine Learning	Versions not published

The 2 CVEs of Elasticsearch X-Pack Machine Learning →

CVE-2018-3824 X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability Not rated

Do you use Elasticsearch X-Pack Machine Learning?

Track this CVE Watch Elasticsearch X-Pack Machine Learning Check my SBOMs

www.cveye.io/en/cve/CVE-2018-3823

Timeline

Published September 19, 2018
Last modified August 5, 2024

References

discuss.elastic.co discuss.elastic.co
www.elastic.co www.elastic.co

Track this CVE

CVE-2018-3823 X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability

Description

Affected products and versions

Other CVEs of Elasticsearch X-Pack Machine Learning