CVE-2017-11481: XSS
Published Dec 8, 2017
·Updated
Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Affected Software
12 affected components
Elastic Kibana=5.6.0
Elastic Kibana=5.6.1
Elastic Kibana=5.6.2
Elastic Kibana=5.6.3
Elastic Kibana=5.6.4
Elastic Kibana=6.0.0
Elastic Kibana=6.0.0-alpha1
Elastic Kibana=6.0.0-alpha2
Elastic Kibana=6.0.0-beta1
Elastic Kibana=6.0.0-beta2
Elastic Kibana=6.0.0-rc1
Elastic Kibana=6.0.0-rc2
Event History
Dec 8, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this Kibana vulnerability?
The vulnerability ID for this Kibana vulnerability is CVE-2017-11481.
2
What is the severity level of CVE-2017-11481?
CVE-2017-11481 has a severity level of 6.1, which is considered medium.
3
What is the affected software for CVE-2017-11481?
The affected software for CVE-2017-11481 is Kibana versions prior to 6.0.1 and 5.6.5.
4
Is there a fix available for CVE-2017-11481?
Yes, a fix is available for CVE-2017-11481. Users should update to Kibana version 6.0.1 or 5.6.5.
5
Where can I find more information about CVE-2017-11481?
More information about CVE-2017-11481 can be found at the following link: https://discuss.elastic.co/t/kibana-6-0-1-and-5-6-5-security-update/110571