CVE-2016-1000220 - Vulnerability Details - OpenCVE

Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.003.

Key SSVC decision points have not yet been added.

Vendors	Products
Elastic	Kibana
Redhat	Openshift

Configuration 1 [-]

OR	cpe:2.3:a:elastic:kibana::::::::
	cpe:2.3:a:elastic:kibana::::::::

Package	CPE	Advisory	Released Date
Red Hat OpenShift Container Platform 3.2
kibana-0:4.1.11-1.el7	cpe:/a:redhat:openshift:3.2::el7	RHSA-2016:1836	2016-09-08T00:00:00Z
openshift-elasticsearch-plugin-0:0.16.0.redhat_1-1.el7	cpe:/a:redhat:openshift:3.2::el7	RHSA-2016:1836	2016-09-08T00:00:00Z
Red Hat OpenShift Enterprise 3.1
kibana-0:4.1.11-1.el7	cpe:/a:redhat:openshift:3.1::el7	RHSA-2016:1836	2016-09-08T00:00:00Z
openshift-elasticsearch-plugin-0:0.16.0.redhat_1-1.el7	cpe:/a:redhat:openshift:3.1::el7	RHSA-2016:1836	2016-09-08T00:00:00Z

No data.

References

Link	Providers
http://www.securityfocus.com/bid/99179
https://nvd.nist.gov/vuln/detail/CVE-2016-1000220
https://www.cve.org/CVERecord?id=CVE-2016-1000220
https://www.elastic.co/community/security

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-06-16T21:00:00.000Z

Updated: 2024-08-06T03:55:27.659Z

Reserved: 2016-09-12T00:00:00.000Z

Link: CVE-2016-1000220

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-06-16T21:29:00.307

Modified: 2026-05-13T00:24:29.033

Link: CVE-2016-1000220

Redhat

Severity : Moderate

Publid Date: 2016-08-03T00:00:00Z

Links: CVE-2016-1000220 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-08-03T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-06-22T09:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "99179", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/99179"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.elastic.co/community/security"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-1000220", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "99179", "refsource": "BID", "url": "http://www.securityfocus.com/bid/99179"}, {"name": "https://www.elastic.co/community/security", "refsource": "CONFIRM", "url": "https://www.elastic.co/community/security"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T03:55:27.659Z"}, "title": "CVE Program Container", "references": [{"name": "99179", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/99179"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.elastic.co/community/security"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-1000220", "datePublished": "2017-06-16T21:00:00.000Z", "dateReserved": "2016-09-12T00:00:00.000Z", "dateUpdated": "2024-08-06T03:55:27.659Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "matchCriteriaId": "F353A236-9768-4194-A97B-127598AC0640", "versionEndExcluding": "4.1.11", "versionStartIncluding": "4.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC33151C-DAC0-4627-B6F4-2EE1C6E18892", "versionEndExcluding": "4.5.4", "versionStartIncluding": "4.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers."}, {"lang": "es", "value": "Las versiones de Kibana anteriores a 4.5.4 y 4.1.11 son vulnerables a un ataque XSS que permitir\u00eda a un atacante ejecutar JavaScript arbitrario en los navegadores de los usuarios."}], "id": "CVE-2016-1000220", "lastModified": "2026-05-13T00:24:29.033", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-06-16T21:29:00.307", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99179"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.elastic.co/community/security"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99179"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.elastic.co/community/security"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2016:1836", "cpe": "cpe:/a:redhat:openshift:3.2::el7", "package": "kibana-0:4.1.11-1.el7", "product_name": "Red Hat OpenShift Container Platform 3.2", "release_date": "2016-09-08T00:00:00Z"}, {"advisory": "RHSA-2016:1836", "cpe": "cpe:/a:redhat:openshift:3.2::el7", "package": "openshift-elasticsearch-plugin-0:0.16.0.redhat_1-1.el7", "product_name": "Red Hat OpenShift Container Platform 3.2", "release_date": "2016-09-08T00:00:00Z"}, {"advisory": "RHSA-2016:1836", "cpe": "cpe:/a:redhat:openshift:3.1::el7", "package": "kibana-0:4.1.11-1.el7", "product_name": "Red Hat OpenShift Enterprise 3.1", "release_date": "2016-09-08T00:00:00Z"}, {"advisory": "RHSA-2016:1836", "cpe": "cpe:/a:redhat:openshift:3.1::el7", "package": "openshift-elasticsearch-plugin-0:0.16.0.redhat_1-1.el7", "product_name": "Red Hat OpenShift Enterprise 3.1", "release_date": "2016-09-08T00:00:00Z"}], "bugzilla": {"description": "kibana: XSS vulnerability ESA-2016-03", "id": "1364389", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1364389"}, "csaw": false, "cvss": {"cvss_base_score": "4.3", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "status": "verified"}, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-79", "details": ["Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.", "A cross-site scripting (XSS) flaw was found in Kibana. A remote attacker could use this flaw to inject arbitrary web script into pages served to other users."], "name": "CVE-2016-1000220", "package_state": [{"cpe": "cpe:/a:redhat:openstack-optools:7", "fix_state": "Not affected", "package_name": "kibana", "product_name": "Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) Operational Tools"}, {"cpe": "cpe:/a:redhat:openstack-optools:8", "fix_state": "Not affected", "package_name": "kibana", "product_name": "Red Hat OpenStack Platform 8 (Liberty) Operational Tools"}, {"cpe": "cpe:/a:redhat:openstack-optools:9", "fix_state": "Not affected", "package_name": "kibana", "product_name": "Red Hat OpenStack Platform 9 (Mitaka) Operational Tools"}], "public_date": "2016-08-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2016-1000220\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-1000220\nhttps://www.elastic.co/community/security"], "threat_severity": "Moderate"}