CVE-2017-8439
published 2017-06-05CVE-2017-8439: Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive…
PriorityP422medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
0.99%
58.1th percentile
Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | — | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kibana: XSS in Time Series Visual Builder could allow an attacket to obtain sensitive user information
vendor_redhat·2017-06-05·CVSS 6.1
CVE-2017-8439 [MEDIUM] CWE-79 kibana: XSS in Time Series Visual Builder could allow an attacket to obtain sensitive user information
kibana: XSS in Time Series Visual Builder could allow an attacket to obtain sensitive user information
Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.
Package: kibana (Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools) - Not affected
Package: kibana (Red Hat OpenShift Enterprise 3) - Not affected
Package: kibana (Red Hat OpenStack Platform 10 (Newton) Operational Tools) - Not affected
Package: kibana (Red Hat OpenStack Platform 8 (Liberty) Operational Tools) - Not affected
Package: kibana (Red Hat OpenStack Platform 9 (Mitaka) Operational Tools) - Not affected
GHSA
GHSA-hxp6-q7cf-mm7m: Kibana version 5
ghsa_unreviewed·2022-05-13
CVE-2017-8439 [MEDIUM] CWE-79 GHSA-hxp6-q7cf-mm7m: Kibana version 5
Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.
No detection rules found.
No public exploits indexed.
https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-releasedhttps://www.elastic.co/community/securityhttps://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-releasedhttps://www.elastic.co/community/security
2017-06-05
Published