CVE-2016-10366: XSS
Published Jun 16, 2017
·Updated
Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.
Affected Software
14 affected components
Elastic Kibana=4.3.0
Elastic Kibana=4.3.1
Elastic Kibana=4.3.2
Elastic Kibana=4.3.3
Elastic Kibana=4.4.0
Elastic Kibana=4.4.1
Elastic Kibana=4.4.2
Elastic Kibana=4.5.0
Elastic Kibana=4.5.1
Elastic Kibana=4.5.2
Elastic Kibana=4.5.3
Elastic Kibana=4.5.4
Elastic Kibana=4.6.0
Elastic Kibana=4.6.1
Event History
Jun 16, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2016-10366?
The severity of CVE-2016-10366 is classified as medium due to the potential for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2016-10366?
To fix CVE-2016-10366, upgrade Kibana to version 4.6.2 or later.
3
Which versions of Kibana are affected by CVE-2016-10366?
Kibana versions from 4.3.0 to 4.6.1 are affected by CVE-2016-10366.
4
What kind of vulnerability is CVE-2016-10366?
CVE-2016-10366 is a cross-site scripting (XSS) vulnerability.
5
Can I mitigate CVE-2016-10366 without upgrading Kibana?
Mitigating CVE-2016-10366 without upgrading is not recommended as the vulnerability requires a patch in the software itself.