CVE-2016-1000220 — Cross-site Scripting in Kibana

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 46.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Kibana
Timeline
PublishedJun 16
Latest updateMay 13

Description

Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶NVDelastic/kibana4.1.0 — 4.1.11+1

🔴Vulnerability Details

2
GHSA
GHSA-v2wv-8cq6-22qw: Kibana before 4↗2022-05-13
▶
CVEList
CVE-2016-1000220: Kibana before 4↗2017-06-16
▶

📋Vendor Advisories

1
Red Hat
kibana: XSS vulnerability ESA-2016-03↗2016-08-03
▶

💬Community

1
Bugzilla
CVE-2016-1000220 kibana: XSS vulnerability ESA-2016-03↗2016-08-05
▶
CVE-2016-1000220 — Cross-site Scripting in Elastic | cvebase