Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.
References
| Link | Resource |
|---|---|
| https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 | Mitigation Vendor Advisory |
| https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-released | Release Notes Vendor Advisory |
| https://www.elastic.co/community/security | Vendor Advisory |
| https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 | Mitigation Vendor Advisory |
| https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-released | Release Notes Vendor Advisory |
| https://www.elastic.co/community/security | Vendor Advisory |
Configurations
History
21 Nov 2024, 03:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 - Mitigation, Vendor Advisory | |
| References | () https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-released - Release Notes, Vendor Advisory | |
| References | () https://www.elastic.co/community/security - Vendor Advisory |
Information
Published : 2017-06-05 14:29
Updated : 2024-11-21 03:34
NVD link : CVE-2017-8439
Mitre link : CVE-2017-8439
CVE.ORG link : CVE-2017-8439
JSON object : View
Products Affected
elastic
- kibana
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')