CVE-2018-3823
Elastic Elasticsearch X-Pack Machine Learning
MEDIUM 5.4
At a glance
- Source
- NVD
- EPSS
- EPSS 0.65 % · percentile 51 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- elastic
- NVD status
- Modified
Description
X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of other ML users viewing the results of the jobs.
Weaknesses (CWE)
- CWE-79 — Cross-site Scripting (XSS)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2018-15611
- GCVE · GCVE-0-2018-3823
CERT-FR advisories
- CERTFR-2025-AVI-0855 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:elastic:elasticsearch_x-pack:*:*:*:*:*:*:*:*< 5.6.9cpe:2.3:a:elastic:elasticsearch_x-pack:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.2.4cpe:2.3:a:elastic:kibana_x-pack:*:*:*:*:*:*:*:*< 5.6.9cpe:2.3:a:elastic:kibana_x-pack:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.2.4cpe:2.3:a:elastic:logstash_x-pack:*:*:*:*:*:*:*:*< 5.6.9cpe:2.3:a:elastic:logstash_x-pack:*:*:*:*:*:*:*:*≥ 6.1.0 < 6.2.4
Affected products
| Product | Versions |
|---|---|
| Elastic · Elasticsearch X-Pack Machine Learning | affected before 6.2.4 and 5.6.9 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |