PT-2017-18331 · Elastic · Kibana

Published 2017-06-05 · Updated 2020-08-14 · CVE-2017-8439

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kibana version 5.4.0

Description A Cross Site Scripting (XSS) bug was found in the Time Series Visual Builder, which could allow an attacker to obtain sensitive information from Kibana users.

Recommendations For Kibana version 5.4.0, update to a version that fixes the XSS bug in the Time Series Visual Builder to prevent potential information disclosure.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-8439

Affected Products

Kibana

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-8439 · Security Note
• https://elastic.co/community/security · Vendor Advisory
• https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952 · Vendor Advisory
• https://elastic.co/blog/kibana-5-4-1-and-5-3-3-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8439 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8439 · Note