« Volver al listado

CVE-2017-11481

Estado: ModificadaMedia (6.1)—

Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Elastic — Kibana

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-11481",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@elastic.co",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Kibana",
          "versions": [
            {
              "status": "affected",
              "version": "before 6.0.1 and 5.6.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-12-08T18:29:00.240",
  "references": [
    {
      "url": "https://discuss.elastic.co/t/kibana-6-0-1-and-5-6-5-security-update/110571",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@elastic.co"
    },
    {
      "url": "https://discuss.elastic.co/t/kibana-6-0-1-and-5-6-5-security-update/110571",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@elastic.co",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users."
    },
    {
      "lang": "es",
      "value": "Las versiones anteriores a la 6.0.1 y 5.6.5 de Kibana presentan una vulnerabilidad de tipo Cross-Site Scripting (XSS) en campos URL que podrían permitir a un atacante obtener información sensible o realizar acciones destructivas en nombre de otros usuarios de Kibana."
    }
  ],
  "lastModified": "2026-06-17T01:01:53.017",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elastic:kibana:5.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C22151C-45AD-44DB-B3E0-178BC93CC8DB"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:5.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3EAB4F2B-26A1-4F1C-BA4D-1B1D2DAFC8EC"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:5.6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EEC2D6D-D18A-4E5A-999F-46101D21EE6E"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:5.6.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92FED321-3988-4E5E-993B-C205F772D41F"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:5.6.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29554EC2-EC90-4EDA-B3BB-705BDF446A04"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:6.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7A7247C-F032-4A8A-A854-9119020AEA53"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:6.0.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FC1C2A2-509F-4C21-9D82-862146EA6B83"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:6.0.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC9A41CB-1852-4BF2-AC39-A92E2EAAB9D7"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:6.0.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "804F2D2F-9A4A-4179-B774-14B7B293C6F7"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:6.0.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC11C2B1-EB71-4D19-A592-99452D4E5285"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:6.0.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8AAE3FEE-A2F1-41C8-9C38-ECA9B3203B44"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:6.0.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "335B93D1-893F-494A-8F0D-176585DDD53A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@elastic.co"
}