CVE-2022-23710
published 2022-03-03CVE-2022-23710: A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary…
PriorityP423medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.74%
50.0th percentile
A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s browser.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | — | — |
| elastic | kibana | — | — |
| elastic | kibana | 7.15.0 – 7.17.0 | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kibana: cross-site-scripting (XSS) issue (ESA-2022-04)
vendor_redhat·2022-02-28·CVSS 6.1
CVE-2022-23710 [MEDIUM] CWE-79 kibana: cross-site-scripting (XSS) issue (ESA-2022-04)
kibana: cross-site-scripting (XSS) issue (ESA-2022-04)
A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s browser.
A flaw was found in Kibana’s data preview pane. This issue allows a Cross-Site scripting attack.
Package: openshift-logging/elasticsearch-rhel8-operator (Logging Subsystem for Red Hat OpenShift) - Will not fix
Package: openshift-logging/kibana6-rhel8 (Logging Subsystem for Red Hat OpenShift) - Will not fix
Package: Kibana (Red Hat JBoss Fuse 6) - Out of support scope
Package: Kibana (Red Hat JBoss Fuse Service Works 6) - Out of support scope
Package: kibana (Red Hat OpenShift Container Platform 3.11) - Will not fix
Package
GHSA
Withdrawn: Cross-site Scripting in Kibana
ghsa·2022-03-04
CVE-2022-23710 [MEDIUM] CWE-79 Withdrawn: Cross-site Scripting in Kibana
Withdrawn: Cross-site Scripting in Kibana
##Withdrawn: This advisory is for Kibana, not ElasticSearch as it was originally published, and is withdrawn as being out of scope of our supported ecosystems.
A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim's browser.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-03-03
Published