CVE-2018-3830
published 2018-09-19CVE-2018-3830: Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive…
PriorityP425medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.87%
77.0th percentile
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | — | — |
| elastic | kibana | 5.3.0 – 6.4.1 | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p82g-h4qx-f53f: Kibana versions 5
ghsa_unreviewed·2022-05-13
CVE-2018-3830 [MEDIUM] CWE-79 GHSA-p82g-h4qx-f53f: Kibana versions 5
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Red Hat
kibana: Cross-site scripting via the source field formatter
vendor_redhat·2018-09-18·CVSS 6.1
CVE-2018-3830 [MEDIUM] CWE-79 kibana: Cross-site scripting via the source field formatter
kibana: Cross-site scripting via the source field formatter
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Package: kibana (Red Hat OpenShift Container Platform 3.10) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.2) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.3) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.4) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.5) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.6) - Not affected
Package: kibana (Red Hat OpenShift Container Pla
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2018:3537https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035https://www.elastic.co/community/securityhttps://access.redhat.com/errata/RHSA-2018:3537https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035https://www.elastic.co/community/security
2018-09-19
Published