CVE-2018-3824

CVE-2018-3824 affects Elastic X-Pack Machine Learning in Elasticsearch/Kibana prior to 6.2.4 and 5.6.9. An attacker who can inject data into an index with a running ML job can cause a cross-site scripting (XSS) payload to execute when a user views ML results, potentially exposing cookies or allow...

CVE-2018-3823

CVE-2018-3823 affects Elastic X-Pack Machine Learning in Kibana/Elasticsearch prior to versions 6.2.4 and 5.6.9. The vulnerability is a cross-site scripting (XSS) flaw caused by improper validation of user-supplied input in ML job configurations; users with manage_ml permissions could embed malic...