CVE-2017-8439: XSS

Published Jun 5, 2017

Updated

Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.

Affected Software

1 affected component

Elastic Kibana=5.4.0

Event History

Jun 5, 2017

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-8439?

CVE-2017-8439 has been classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2017-8439?

To fix CVE-2017-8439, upgrade Kibana to version 5.4.1 or later, which includes a patch for this vulnerability.

What impact does CVE-2017-8439 have on Kibana users?

CVE-2017-8439 could allow attackers to execute malicious scripts in the context of the Kibana user session, potentially compromising sensitive user information.

Which version of Kibana is affected by CVE-2017-8439?

Only Kibana version 5.4.0 is affected by CVE-2017-8439.

Can CVE-2017-8439 be exploited remotely?

Yes, CVE-2017-8439 can be exploited remotely if an attacker can trick a Kibana user into loading a malicious link.