Description
Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Remediation
References
http://www.securityfocus.com/bid/102734
https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763
Related Vulnerabilities
CVE-2020-28461 Vulnerability in npm package js-ini
CVE-2022-24377 Vulnerability in npm package cycle-import-check
CVE-2017-5662 Vulnerability in maven package org.apache.xmlgraphics:batik-rasterizer
CVE-2018-14732 Vulnerability in npm package webpack-dev-server
CVE-2017-2602 Vulnerability in maven package org.jenkins-ci.main:jenkins-core