CVE-2018-3823CWE-79

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability

published September 19, 2018

CVSS
—
EPSS
1%
Percentile
50.4
In the wild
Unconfirmed
What it is

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of other ML users viewing the results of the jobs.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00647 · 50.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2018-09-19T19:00Z
EPSS history
Timeline
  • 19 SEP 19:00Z
    X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability
    cvelistv5