{"id":"CVE-2016-10366","details":"Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.","modified":"2026-07-08T05:48:03.763730286Z","published":"2017-06-16T21:29:00.557Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:elastic:kibana:4.3.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"}],"source":"CPE_STRING","vendor_product":"elastic:kibana"}]},"references":[{"type":"ADVISORY","url":"https://www.elastic.co/community/security"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"e32749e1fa442853975ce2abd5ac2fd88a2dcf58"},{"last_affected":"3ff0f9b07dbcf2f7552d204777ee426885886609"}],"database_specific":{"cpe":["cpe:2.3:a:elastic:kibana:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:4.3.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:4.3.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:4.3.3:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:4.4.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:4.4.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:4.4.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:4.5.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:4.5.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:4.5.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:4.5.3:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:4.5.4:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:4.6.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:4.6.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"introduced":"4.3.1"},{"last_affected":"4.3.1"},{"introduced":"4.3.2"},{"last_affected":"4.3.2"},{"introduced":"4.3.3"},{"last_affected":"4.3.3"},{"introduced":"4.4.0"},{"last_affected":"4.4.0"},{"introduced":"4.4.1"},{"last_affected":"4.4.1"},{"introduced":"4.4.2"},{"last_affected":"4.4.2"},{"introduced":"4.5.0"},{"last_affected":"4.5.0"},{"introduced":"4.5.1"},{"last_affected":"4.5.1"},{"introduced":"4.5.2"},{"last_affected":"4.5.2"},{"introduced":"4.5.3"},{"last_affected":"4.5.3"},{"introduced":"4.5.4"},{"last_affected":"4.5.4"},{"introduced":"4.6.0"},{"last_affected":"4.6.0"},{"introduced":"4.6.1"},{"last_affected":"4.6.1"}],"source":"CPE_STRING"}}],"versions":["4.3.0","4.3.1","4.3.2","4.3.3","4.4.0","4.4.1","4.4.2","4.5.0","4.5.1","4.5.2","4.5.3","4.5.4","4.6.0","4.6.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10366.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}