{"id":"CVE-2018-3830","details":"Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.","modified":"2026-07-08T05:56:23.716103581Z","published":"2018-09-19T19:29:01.203Z","database_specific":{"unresolved_ranges":[{"vendor_product":"redhat:openshift_container_platform","cpes":["cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.11"},{"last_affected":"3.11"}],"source":"CPE_STRING"}]},"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3537"},{"type":"ADVISORY","url":"https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035"},{"type":"ADVISORY","url":"https://www.elastic.co/community/security"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"3adb13b1f49935973b974a2517caa0d4d59bf4d0"},{"last_affected":"e36acdb78ec6499be861ae1b2dac264cce2f8b10"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.3.0"},{"last_affected":"6.4.1"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-3830.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"ce7908cdac87af1e3b02ac4038fc3985602cf95a"},{"last_affected":"2872c74872c54d91e3e00b67c7bbc61659df0ba7"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.3.0"},{"last_affected":"6.4.1"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-3830.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}