CVE-2018-3830 — Cross-site Scripting in Kibana

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.7%
top 27.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Elastic KibanaRedhat Openshift Container Platform
Timeline
PublishedSep 19
Latest updateMay 13

Description

Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDelastic/kibana5.3.0 — 6.4.1
▶CVEListV5elastic/kibanaafter 5.3.0, before 5.6.12 and 6.4.1

Also affects: Openshift Container Platform 3.11

🔴Vulnerability Details

2
GHSA
GHSA-p82g-h4qx-f53f: Kibana versions 5↗2022-05-13
▶
CVEList
CVE-2018-3830: Kibana versions 5↗2018-09-19
▶

📋Vendor Advisories

1
Red Hat
kibana: Cross-site scripting via the source field formatter↗2018-09-18
▶

💬Community

1
Bugzilla
CVE-2018-3830 kibana: Cross-site scripting via the source field formatter↗2018-09-24
▶
CVE-2018-3830 — Cross-site Scripting in Elastic Kibana | cvebase