Note:
This project will be discontinued after December 13, 2021. [more]
2018-03-30
Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Products | Kibana |
Type | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79) |
First patch | - None (likely due to unavailable code) |
Links |
• http://www.securityfocus.com/bid/102734
• https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763 |