Medium severity5.4NVD Advisory· Published Sep 19, 2018· Updated Jun 17, 2026

CVE-2018-3823

Description

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of other ML users viewing the results of the jobs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Elastic/Elasticsearch X Pack
cpe:2.3:a:elastic:elasticsearch_x-pack:*:*:*:*:*:*:*:*
Range: <5.6.9
Elastic/Kibana X Pack
cpe:2.3:a:elastic:kibana_x-pack:*:*:*:*:*:*:*:*
Range: <5.6.9
Elastic/Logstash X Pack
cpe:2.3:a:elastic:logstash_x-pack:*:*:*:*:*:*:*:*
Range: <5.6.9
Elastic/X-Pack Machine Learningllm-fuzzy2 versions
<6.2.4 || <5.6.9+ 1 more
- (no CPE)range: <6.2.4 || <5.6.9
- (no CPE)range: before 6.2.4 and 5.6.9

Patches

Vulnerability mechanics

References

discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422nvdVendor Advisory
www.elastic.co/community/securitynvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000