Description

Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

Remediation

References

https://discuss.elastic.co/t/kibana-6-0-1-and-5-6-5-security-update/110571

Related Vulnerabilities

CVE-2023-29520 Vulnerability in maven package org.xwiki.platform:xwiki-platform-localization-source-wiki

CVE-2017-12612 Vulnerability in maven package org.apache.spark:spark-core

CVE-2019-10410 Vulnerability in maven package org.jenkins-ci.plugins:log-parser

CVE-2022-28157 Vulnerability in maven package com.surenpi.jenkins:phoenix-autotest

CVE-2014-3742 Vulnerability in npm package hapi

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Vendor Advisory