A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s browser.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as
    Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s browser.
    (CVE-2022-23710)

According to its self-reported version number, the Kibana application running on the remote host is 7.15.x prior to 7.17.1. It is, therefore, affected by : 

- Privilege Escalation when upgrading from version 6.x to 7.x would disable the in-built protections on the security index (CVE-2022-23708)

- Cross-Site Scripting in the Data Preview Pane (CVE-2022-23710)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
416781	SCA: security update for org.elasticsearch:elasticsearch (GHSA-m6gg-86c6-gfr9)	Tenable Cloud Security	SCA Checks	medium
416781	SCA: security update for org.elasticsearch:elasticsearch (GHSA-m6gg-86c6-gfr9)	Tenable Self-Hosted Container Security	SCA Checks	medium
113519	Kibana 7.15.0 < 7.17.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2022-23710

medium

Tenable Plugins

medium

medium

medium