CVE-2022-23710 — Cross-site Scripting in Kibana

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 45.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Kibana
Timeline
PublishedMar 3
Latest updateMar 4

Description

A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s browser.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDelastic/kibana7.15.0 — 7.17.0+1
▶CVEListV5elastic/kibanaFor self-managed deployments the issue impacts versions 7.15.0, 7.15.1, and 7.15.2 For Elastic Cloud Services the issue impacts versions 7.15.0 through 7.17.0, and 8.0.0

🔴Vulnerability Details

2
GHSA
Withdrawn: Cross-site Scripting in Kibana↗2022-03-04
▶
CVEList
CVE-2022-23710: A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow↗2022-03-03
▶

📋Vendor Advisories

1
Red Hat
kibana: cross-site-scripting (XSS) issue (ESA-2022-04)↗2022-02-28
▶
CVE-2022-23710 — Cross-site Scripting in Elastic Kibana | cvebase