CVE-2020-7017 — Cross-site Scripting in Elasticsearch Kibana

CWE-79 — Cross-site Scripting6 documents6 sources
Severity
6.7MEDIUMNVD
EPSS
1.2%
top 21.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Elasticsearch KibanaElastic KibanaOracle Communications Billing AND Revenue Management+2 more
Timeline
PublishedJul 27
Latest updateMay 24

Description

In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or create a region map visualization could obtain sensitive information or perform destructive actions on behalf of Kibana users who view the region map visualization.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:LExploitability: 1.2 | Impact: 5.5

Affected Packages5 packages

▶NVDelasticsearch/kibana7.0.0 — 7.8.1+1
▶CVEListV5elastic/kibanabefore 6.8.11 and 7.8.1

🔴Vulnerability Details

2
GHSA
GHSA-68q8-gcx9-m4rq: In Kibana versions before 6↗2022-05-24
▶
CVEList
CVE-2020-7017: In Kibana versions before 6↗2020-07-27
▶

📋Vendor Advisories

2
Oracle
Oracle Oracle Communications Applications Risk Matrix: Balance Monitoring Manager (Kibana) — CVE-2020-7017↗2021-07-15
▶
Red Hat
kibana: stored XSS in region map visualization↗2020-07-27
▶

💬Community

1
Bugzilla
CVE-2020-7017 kibana: stored XSS in region map visualization↗2020-08-04
▶
CVE-2020-7017 — Cross-site Scripting in Elasticsearch | cvebase