« Volver al listado

CVE-2017-8440

Estado: ModificadaMedia (6.1)—

Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Elastic — Kibana

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-8440",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@elastic.co",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Kibana",
          "versions": [
            {
              "status": "affected",
              "version": "5.3.0 to 5.3.3"
            },
            {
              "status": "affected",
              "version": "5.4.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-06-05T14:29:00.357",
  "references": [
    {
      "url": "https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security@elastic.co"
    },
    {
      "url": "https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-released",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "security@elastic.co"
    },
    {
      "url": "https://www.elastic.co/community/security",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@elastic.co"
    },
    {
      "url": "https://discuss.elastic.co/t/elastic-stack-5-4-1-and-5-3-3-security-updates/87952",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.elastic.co/blog/kibana-5-4-1-and-5-3-3-released",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.elastic.co/community/security",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@elastic.co",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users."
    },
    {
      "lang": "es",
      "value": "A partir de la versión 5.3.0, Kibana tenía una vulnerabilidad de cross-site scripting (XSS) en la página de Discover que podría permitir a un atacante obtener información confidencial o realizar acciones destructivas en nombre de otros usuarios de Kibana."
    }
  ],
  "lastModified": "2026-06-17T01:26:22.313",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elastic:kibana:5.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D88ABA67-0305-46E3-AAED-E3FC9F963F69"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:5.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93558649-84F5-448A-B191-1A0052150929"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:5.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02CD0D6D-2AC7-46E2-ABBE-B780F47DD4B9"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:5.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E741D583-C568-4A93-A344-A54267B292F2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@elastic.co"
}