In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or create a region map visualization could obtain sensitive information or perform destructive actions on behalf of Kibana users who view the region map visualization.

According to its self-reported version number, the Kibana application running on the remote host is prior to 7.8.1. It is, therefore, affected by :

- A Regular Expression Denial Of Service flaw in Timelion (CVE-2020-7016)

- A Cross-Site Scripting in region map visualization (CVE-2020-7017)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the kibana package has been released.

ID	Name	Product	Family	Type	Severity
113534	Kibana < 7.8.1 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
141639	Photon OS 1.0: Kibana PHSA-2020-1.0-0321	Nessus	PhotonOS Local Security Checks	Local	medium
140662	Photon OS 2.0: Kibana PHSA-2020-2.0-0281	Nessus	PhotonOS Local Security Checks	Local	medium
140411	Photon OS 3.0: Kibana PHSA-2020-3.0-0135	Nessus	PhotonOS Local Security Checks	Local	medium

Detections

Analytics

CVE-2020-7017

medium

Tenable Plugins

medium

medium

medium

medium