{"data":{"id":"84d1c864-e530-41ba-9496-113792c2925f","title":"CVE-2018-3823: X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with…","summary":"X-Pack Machine Learning versions before 6.2.4 and 5.6.9 contain a cross-site scripting (XSS) flaw, tracked as CVE-2018-3823 and classified as CWE-79. A user with manage_ml permissions can create jobs containing malicious data in their configuration. Other ML users viewing the results of those jobs could then have sensitive information exposed or destructive actions performed on their behalf.","solution":"Fixed in 6.2.4 and 5.6.9 of Elastic Stack, per the Elastic security update referenced in the source (https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422).","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-3823","publishedAt":"2018-09-19T19:29:00.220Z","cveId":"CVE-2018-3823","cweIds":["CWE-79","CWE-79"],"cvssScore":"5.4","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["X-Pack Machine Learning","Elastic Stack"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"X-Pack Machine Learning cross-site scripting via job configuration","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00647,"epssCheckedAt":"2026-11-04T12:08:33.690Z","kevDateAdded":null,"advisoryAliases":["GHSA-4q33-p7w3-3rq8"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-29T06:10:02.879Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-198","CAPEC-86"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}