{"id":"CVE-2017-11479","details":"Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.","modified":"2026-07-08T05:51:57.613383386Z","published":"2017-09-29T01:34:48.530Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"5.1.0"},{"last_affected":"5.1.0"}],"source":"CPE_STRING","vendor_product":"elasticsearch:kibana","cpes":["cpe:2.3:a:elasticsearch:kibana:5.1.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2019/10/24/1"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2019/10/29/3"},{"type":"REPORT","url":"https://discuss.elastic.co/t/x-pack-alerting-and-kibana-5-6-1-security-update/101884"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"253032b4a7818992af360097e3ddc1475fa7b044"},{"last_affected":"781a83507f0598b36512cba088ffeefa73b4bbe6"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:elastic:kibana:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.0.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.0.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.1.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.1.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.2.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.2.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.3.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.3.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.3.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.3.3:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.4.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.4.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.4.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.4.3:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.5.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.5.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.5.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.5.3:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.6.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.0.0"},{"last_affected":"5.0.0"},{"introduced":"5.0.1"},{"last_affected":"5.0.1"},{"introduced":"5.0.2"},{"last_affected":"5.0.2"},{"introduced":"5.1.1"},{"last_affected":"5.1.1"},{"introduced":"5.1.2"},{"last_affected":"5.1.2"},{"introduced":"5.2.0"},{"last_affected":"5.2.0"},{"introduced":"5.2.1"},{"last_affected":"5.2.1"},{"introduced":"5.2.2"},{"last_affected":"5.2.2"},{"introduced":"5.3.0"},{"last_affected":"5.3.0"},{"introduced":"5.3.1"},{"last_affected":"5.3.1"},{"introduced":"5.3.2"},{"last_affected":"5.3.2"},{"introduced":"5.3.3"},{"last_affected":"5.3.3"},{"introduced":"5.4.0"},{"last_affected":"5.4.0"},{"introduced":"5.4.1"},{"last_affected":"5.4.1"},{"introduced":"5.4.2"},{"last_affected":"5.4.2"},{"introduced":"5.4.3"},{"last_affected":"5.4.3"},{"introduced":"5.5.0"},{"last_affected":"5.5.0"},{"introduced":"5.5.1"},{"last_affected":"5.5.1"},{"introduced":"5.5.2"},{"last_affected":"5.5.2"},{"introduced":"5.5.3"},{"last_affected":"5.5.3"},{"introduced":"5.6.0"},{"last_affected":"5.6.0"}]}}],"versions":["5.0.0","5.0.1","5.0.2","5.1.1","5.1.2","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.3.2","5.3.3","5.4.0","5.4.1","5.4.2","5.4.3","5.5.0","5.5.1","5.5.2","5.5.3","5.6.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11479.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"c5af7a418333df6a934b8d1a5648c675641388bd"},{"last_affected":"12d17c6d111705f0c0c29fbab66eb22eda31dcdf"}],"database_specific":{"extracted_events":[{"introduced":"5.0.0"},{"last_affected":"5.0.0"},{"introduced":"5.0.1"},{"last_affected":"5.0.1"},{"introduced":"5.0.2"},{"last_affected":"5.0.2"},{"introduced":"5.1.1"},{"last_affected":"5.1.1"},{"introduced":"5.1.2"},{"last_affected":"5.1.2"},{"introduced":"5.2.0"},{"last_affected":"5.2.0"},{"introduced":"5.2.1"},{"last_affected":"5.2.1"},{"introduced":"5.2.2"},{"last_affected":"5.2.2"},{"introduced":"5.3.0"},{"last_affected":"5.3.0"},{"introduced":"5.3.1"},{"last_affected":"5.3.1"},{"introduced":"5.3.2"},{"last_affected":"5.3.2"},{"introduced":"5.3.3"},{"last_affected":"5.3.3"},{"introduced":"5.4.0"},{"last_affected":"5.4.0"},{"introduced":"5.4.1"},{"last_affected":"5.4.1"},{"introduced":"5.4.2"},{"last_affected":"5.4.2"},{"introduced":"5.4.3"},{"last_affected":"5.4.3"},{"introduced":"5.5.0"},{"last_affected":"5.5.0"},{"introduced":"5.5.1"},{"last_affected":"5.5.1"},{"introduced":"5.5.2"},{"last_affected":"5.5.2"},{"introduced":"5.5.3"},{"last_affected":"5.5.3"},{"introduced":"5.6.0"},{"last_affected":"5.6.0"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:elastic:kibana:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.0.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.0.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.1.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.1.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.2.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.2.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.2.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.3.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.3.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.3.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.3.3:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.4.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.4.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.4.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.4.3:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.5.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.5.1:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.5.2:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.5.3:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:5.6.0:*:*:*:*:*:*:*"]}}],"versions":["5.0.0","5.0.1","5.0.2","5.1.1","5.1.2","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.3.2","5.3.3","5.4.0","5.4.1","5.4.2","5.4.3","5.5.0","5.5.1","5.5.2","5.5.3","5.6.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-11479.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}