CVE-2017-8439 — Cross-site Scripting in Kibana

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 43.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Kibana
Timeline
PublishedJun 5
Latest updateMay 13

Description

Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5elastic/kibana5.4.0
▶NVDelastic/kibana5.4.0

🔴Vulnerability Details

2
GHSA
GHSA-hxp6-q7cf-mm7m: Kibana version 5↗2022-05-13
▶
CVEList
CVE-2017-8439: Kibana version 5↗2017-06-05
▶

📋Vendor Advisories

1
Red Hat
kibana: XSS in Time Series Visual Builder could allow an attacket to obtain sensitive user information↗2017-06-05
▶

💬Community

1
Bugzilla
CVE-2017-8439 kibana: XSS in Time Series Visual Builder could allow an attacket to obtain sensitive user information↗2018-01-12
▶
CVE-2017-8439 — Cross-site Scripting in Elastic Kibana | cvebase