CVE-2022-23713 — Cross-site Scripting in Kibana

CWE-79 — Cross-site Scripting4 documents4 sources

Severity

6.1MEDIUMNVD

EPSS

0.8%

top 26.10%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Elastic Kibana

Timeline

PublishedJul 6

Latest updateJul 7

Description

A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDelastic/kibana7.0.0 — 7.17.5+1

▶CVEListV5elastic/kibanaVersions 7.0.0 through 7.17.4 and 8.0.0 through 8.2.3

🔴Vulnerability Details

GHSA

GHSA-q6vc-px9c-m9vw: A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed↗2022-07-07

▶

CVEList

CVE-2022-23713: A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed↗2022-07-06

▶

📋Vendor Advisories

Red Hat

kibana: Kibana cross-site-scripting (XSS) issue (ESA-2022-08)↗2022-07-06

▶