CVE-2017-11479
published 2017-09-29CVE-2017-11479: Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or…
PriorityP423medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
1.07%
60.7th percentile
Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elasticsearch | kibana | — | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kibana: XSS vulnerability in Timelion could allow an attacker obtain sensitive information or perform user actions
vendor_redhat·2017-09-28·CVSS 6.1
CVE-2017-11479 [MEDIUM] CWE-79 kibana: XSS vulnerability in Timelion could allow an attacker obtain sensitive information or perform user actions
kibana: XSS vulnerability in Timelion could allow an attacker obtain sensitive information or perform user actions
Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Package: kibana (Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools) - Not affected
Package: kibana (Red Hat OpenShift Enterprise 3) - Not affected
Package: kibana (Red Hat OpenStack Platform 8 (Liberty) Operational Tools) - Not affected
Package: kibana (Red Hat OpenStack Platform 9 (Mitaka) Operational Tools) - Not affected
GHSA
GHSA-3chc-mx35-j8gg: Kibana versions prior to 5
ghsa_unreviewed·2022-05-13
CVE-2017-11479 [MEDIUM] CWE-79 GHSA-3chc-mx35-j8gg: Kibana versions prior to 5
Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2019/10/24/1http://www.openwall.com/lists/oss-security/2019/10/29/3https://discuss.elastic.co/t/x-pack-alerting-and-kibana-5-6-1-security-update/101884http://www.openwall.com/lists/oss-security/2019/10/24/1http://www.openwall.com/lists/oss-security/2019/10/29/3https://discuss.elastic.co/t/x-pack-alerting-and-kibana-5-6-1-security-update/101884
2017-09-29
Published