Note:
This project will be discontinued after December 13, 2021. [more]
2019-03-25
Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
| Products | Kibana |
| Type | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79) |
| First patch | - None (likely due to unavailable code) |
| Links |
• https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077
• https://access.redhat.com/errata/RHSA-2019:2860 • https://www.elastic.co/community/security |