CVE-2017-8440: XSS
Published Jun 5, 2017
·Updated
Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Affected Software
4 affected components
Elastic Kibana=5.3.0
Elastic Kibana=5.3.1
Elastic Kibana=5.3.2
Elastic Kibana=5.4.0
Event History
Jun 5, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-8440?
CVE-2017-8440 is considered a high severity cross-site scripting (XSS) vulnerability affecting Kibana versions 5.3.0 to 5.4.0.
2
How do I fix CVE-2017-8440?
To fix CVE-2017-8440, upgrade Kibana to version 5.4.1 or later where this vulnerability has been patched.
3
Which versions of Kibana are affected by CVE-2017-8440?
CVE-2017-8440 affects Kibana versions 5.3.0, 5.3.1, 5.3.2, and 5.4.0.
4
Can CVE-2017-8440 allow unauthorized access to data in Kibana?
Yes, CVE-2017-8440 can allow an attacker to obtain sensitive information from other Kibana users.
5
Is CVE-2017-8440 related to any specific features in Kibana?
CVE-2017-8440 is specifically tied to the Discover page in Kibana where the XSS vulnerability exists.