SB2017061707 - Multiple vulnerabilities in Kibana

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Authorization (CVE-ID: CVE-2016-1000219)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.

2) Cross-site scripting (CVE-ID: CVE-2016-1000220)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.

Remediation

Install update from vendor's website.

References

• http://www.securityfocus.com/bid/99178
• https://www.elastic.co/community/security
• http://www.securityfocus.com/bid/99179