CVE-2020-7017

MEDIUM

Kibana < 6.8.11 and 7.8.1 - Stored Cross-Site Scripting in Region Map Visualization

Title source: llm
STIX 2.1

Description

In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or create a region map visualization could obtain sensitive information or perform destructive actions on behalf of Kibana users who view the region map visualization.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_misc
https://www.elastic.co/community/security/
Third Party Advisory x_refsource_misc
https://www.oracle.com//security-alerts/cpujul2021.html

Scores

CVSS v3 6.7
EPSS 0.0122
EPSS Percentile 65.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

Details

CWE
CWE-79
Status published
Products (4)
elasticsearch/kibana < 6.8.11
oracle/communications_billing_and_revenue_management 12.0.0.3.0
oracle/communications_cloud_native_core_network_function_cloud_native_environment 1.7.0
oracle/peoplesoft_enterprise_peopletools 8.58
Published Jul 27, 2020
Tracked Since Feb 18, 2026