CVE-2017-8440
published 2017-06-05CVE-2017-8440: Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive…
PriorityP422medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
0.99%
58.1th percentile
Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | — | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jv8f-xj77-j348: Starting in version 5
ghsa_unreviewed·2022-05-13
CVE-2017-8440 [MEDIUM] CWE-79 GHSA-jv8f-xj77-j348: Starting in version 5
Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Red Hat
kibana: XSS in Discover page could allow attacker to obtain sensitive information or perform user actions
vendor_redhat·2017-06-05·CVSS 6.1
CVE-2017-8440 [MEDIUM] CWE-79 kibana: XSS in Discover page could allow attacker to obtain sensitive information or perform user actions
kibana: XSS in Discover page could allow attacker to obtain sensitive information or perform user actions
Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Package: kibana (Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools) - Not affected
Package: kibana (Red Hat OpenShift Enterprise 3) - Not affected
Package: kibana (Red Hat OpenStack Platform 8 (Liberty) Operational Tools) - Not affected
Package: kibana (Red Hat OpenStack Platform 9 (Mitaka) Operational Tools) - Not affected
No detection rules found.
No public exploits indexed.
https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-releasedhttps://www.elastic.co/community/securityhttps://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-releasedhttps://www.elastic.co/community/security
2017-06-05
Published