Description
Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
Remediation
References
http://www.securityfocus.com/bid/102734
https://discuss.elastic.co/t/elastic-stack-6-1-2-and-5-6-6-security-update/115763
Related Vulnerabilities
CVE-2020-2194 Vulnerability in maven package io.jenkins.plugins:echarts-api
CVE-2018-1999024 Vulnerability in npm package mathjax
CVE-2021-25987 Vulnerability in npm package hexo
CVE-2022-1243 Vulnerability in maven package org.webjars.bower:urijs
CVE-2017-12648 Vulnerability in maven package com.liferay:com.liferay.frontend.taglib