Note:
This project will be discontinued after December 13, 2021. [more]
2018-09-19
Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
| Products | Kibana, Openshift_container_platform |
| Type | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79) |
| First patch | - None (likely due to unavailable code) |
| Links |
• https://access.redhat.com/errata/RHSA-2018:3537
• https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035 • https://www.elastic.co/community/security |