Cross-site scripting in Kibana - CVE-2016-1000220
Published: June 17, 2017 / Updated: July 18, 2020
Vulnerability identifier: #VU31416
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2016-1000220
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.
Affected software
Kibana
How to mitigate CVE-2016-1000220
Install update from vendor's website.
Kibana - update to 4.5.4