CVE-2019-7608
published 2019-03-25CVE-2019-7608: Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or…
PriorityP424medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
1.34%
67.7th percentile
Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | < 5.6.15 | 5.6.15 |
| elastic | kibana | — | — |
| elastic | kibana | >= 6.0.0 < 6.6.1 | 6.6.1 |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kibana: Cross-site scripting vulnerability permits perform destructive actions on behalf of other Kibana users
vendor_redhat·2018-02-19·CVSS 6.1
CVE-2019-7608 [MEDIUM] CWE-79 kibana: Cross-site scripting vulnerability permits perform destructive actions on behalf of other Kibana users
kibana: Cross-site scripting vulnerability permits perform destructive actions on behalf of other Kibana users
Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Package: kibana (Red Hat OpenShift Container Platform 3.10) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.4) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.5) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.6) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.7) - Not affected
Package: kibana (Red Hat OpenShift Container Platform 3.9) - Not affected
Package: kibana (Re
GHSA
GHSA-24qm-h8fv-cv5c: Kibana versions before 5
ghsa_unreviewed·2022-05-13
CVE-2019-7608 [MEDIUM] CWE-79 GHSA-24qm-h8fv-cv5c: Kibana versions before 5
Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHBA-2019:2824https://access.redhat.com/errata/RHSA-2019:2860https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077https://www.elastic.co/community/securityhttps://access.redhat.com/errata/RHBA-2019:2824https://access.redhat.com/errata/RHSA-2019:2860https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077https://www.elastic.co/community/security
2019-03-25
Published