Elastic Kibana X-Pack vulnerabilities

2 CVEs affecting Elastic Kibana X-Pack, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-3824, published 2018-09-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-3824, published 2018-09-19. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then…
CVE-2018-3823, published 2018-09-19. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs containing malicious data as part of their…