CVE-2018-3823: XSS
X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manageml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of other ML users viewing the results of the jobs.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-3823?
CVE-2018-3823 has a high severity rating due to the potential for unauthorized access to sensitive information.
How do I fix CVE-2018-3823?
To fix CVE-2018-3823, upgrade to Elasticsearch, Kibana, or Logstash versions 5.6.9 or later, or 6.2.4 or later.
What type of vulnerability is CVE-2018-3823?
CVE-2018-3823 is a cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2018-3823?
Users with manage_ml permissions are primarily affected by CVE-2018-3823.
What could an attacker achieve with CVE-2018-3823?
An attacker could potentially obtain sensitive information or perform destructive actions using the XSS vulnerability in CVE-2018-3823.