SB2017060507 - Multiple vulnerabilities in Kibana

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2017-8439)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.

2) Cross-site scripting (CVE-ID: CVE-2017-8440)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

Remediation

Install update from vendor's website.

References

• https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952
• https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-released
• https://www.elastic.co/community/security