Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualizations could create a malicious visualization. If another Kibana user views that visualization or a dashboard containing the visualization it could execute JavaScript in the victimï¿½s browser.

An update of the kibana package has been released.

According to its self-reported version number, the Kibana application running on the remote host is prior to 6.8.6 or 7.x prior to 7.5.1. It is, therefore, affected by a cross-site scripting (XSS) vulnerability in the coordinate and region map visualizations.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
137713	Photon OS 2.0: Kibana PHSA-2020-2.0-0253	Nessus	PhotonOS Local Security Checks	high
137639	Photon OS 1.0: Kibana PHSA-2020-1.0-0301	Nessus	PhotonOS Local Security Checks	high
136578	Photon OS 3.0: Kibana PHSA-2020-3.0-0088	Nessus	PhotonOS Local Security Checks	medium
98977	Kibana 7.x < 7.5.1 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
98976	Kibana < 6.8.6 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2019-7621

medium

Tenable Plugins

high

high

medium

medium

medium