CVE-2016-1000220: XSS
Published Jun 16, 2017
·Updated
Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.
Affected Software
2 affected components
Elastic Kibana>=4.1.0<4.1.11
Elastic Kibana>=4.5.0<4.5.4
Event History
Jun 16, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-1000220?
CVE-2016-1000220 has been rated as a medium severity XSS vulnerability.
2
How do I fix CVE-2016-1000220?
To fix CVE-2016-1000220, upgrade Kibana to version 4.1.11 or later, or 4.5.4 or later.
3
What versions of Kibana are affected by CVE-2016-1000220?
Kibana versions prior to 4.1.11 and 4.5.4 are affected by CVE-2016-1000220.
4
What type of vulnerability is CVE-2016-1000220?
CVE-2016-1000220 is an XSS (Cross-Site Scripting) vulnerability.
5
Can CVE-2016-1000220 be exploited remotely?
Yes, CVE-2016-1000220 can be exploited remotely by an attacker to execute arbitrary JavaScript in users' browsers.