CVE-2022-23707
published 2022-02-11CVE-2022-23707: An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject…
PriorityP424medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.52%
40.1th percentile
An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index pattern which could execute against other users
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | — | — |
| elastic | kibana | >= 7.5.1 < 7.17.0 | 7.17.0 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xj4h-2rjf-hh84: An XSS vulnerability was found in Kibana index patterns
ghsa_unreviewed·2022-02-12
CVE-2022-23707 [MEDIUM] CWE-79 GHSA-xj4h-2rjf-hh84: An XSS vulnerability was found in Kibana index patterns
An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index pattern which could execute against other users
Red Hat
Kibana: Cross-site scripting issue (ESA-2022-01)
vendor_redhat·2022-02-03·CVSS 5.4
CVE-2022-23707 [MEDIUM] CWE-79 Kibana: Cross-site scripting issue (ESA-2022-01)
Kibana: Cross-site scripting issue (ESA-2022-01)
An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index pattern which could execute against other users
A Cross-Site Scripting (XSS) vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permission to create index patterns can inject malicious javascript into the index pattern, which could execute against other users.
Package: openshift-logging/elasticsearch-rhel8-operator (Logging Subsystem for Red Hat OpenShift) - Will not fix
Package: openshift-logging/kibana6-rhel8 (Logging Subsystem for Red Hat OpenShift) - Will not fix
Package: Kibana (Red Hat JBo
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-02-11
Published