CVE-2018-3823
Elastic Elasticsearch X-Pack Machine Learning
MEDIUM 5.4
En bref
- Source
- NVD
- EPSS
- EPSS 0.65 % · centile 51 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- elastic
- Statut NVD
- Modified
Description
X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of other ML users viewing the results of the jobs.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2018-15611
- GCVE · GCVE-0-2018-3823
Avis du CERT-FR
- CERTFR-2025-AVI-0855 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:elastic:elasticsearch_x-pack:*:*:*:*:*:*:*:*< 5.6.9cpe:2.3:a:elastic:elasticsearch_x-pack:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.2.4cpe:2.3:a:elastic:kibana_x-pack:*:*:*:*:*:*:*:*< 5.6.9cpe:2.3:a:elastic:kibana_x-pack:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.2.4cpe:2.3:a:elastic:logstash_x-pack:*:*:*:*:*:*:*:*< 5.6.9cpe:2.3:a:elastic:logstash_x-pack:*:*:*:*:*:*:*:*≥ 6.1.0 < 6.2.4
Produits affectés
| Produit | Versions |
|---|---|
| Elastic · Elasticsearch X-Pack Machine Learning | affected before 6.2.4 and 5.6.9 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |