CVE-2018-3823CWE-79

CVE-2018-3823: falha em Elasticsearch X-Pack Machine Learning

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Elasticsearch X-Pack Machine Learning

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 0.6%
X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of other ML users viewing the results of the jobs.
Produtos afetados
Elastic · Elasticsearch X-Pack Machine Learning
CVEs relacionadas — Elasticsearch X-Pack Machine Learning

No mesmo produto, das mais perigosas para as menos.

CVE-2018-3824—CVE-2018-3824EPSS 0.9%