Kibana CVE-2015-4093 Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	75107
Class:	Input Validation Error
CVE:	CVE-2015-4093
Remote:	Yes
Local:	No
Published:	Jun 09 2015 12:00AM
Updated:	Jun 09 2015 12:00AM
Credit:	Kevin Kluge
Vulnerable:	Elasticsearch Kibana 4.0.2 Elasticsearch Kibana 4.0.1 Elasticsearch Kibana 4.0
Not Vulnerable:	Elasticsearch Kibana 4.1 Elasticsearch Kibana 4.0.3

Kibana CVE-2015-4093 Unspecified Cross Site Scripting Vulnerability

Kibana is prone to an unspecified cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Kibana versions 4.0.0, 4.0.1 and 4.0.2 are vulnerable.

Kibana CVE-2015-4093 Unspecified Cross Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user into visiting a specially crafted URL.

Kibana CVE-2015-4093 Unspecified Cross Site Scripting Vulnerability

References:

• Kibana download page (Elasticsearch)
  
• Kibana vulnerability CVE-2015-4093 (Seclists.org)