Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization could allow the attacker to obtain sensitive information from, or perform destructive actions, on behalf of Kibana users who edit the TSVB visualization.

According to its self-reported version number, the Kibana application running on the remote host is 5.4.0 prior to 7.7.1. It is, therefore, affected by : 

- A Cross-Site Scripting in the TSVB visualization (CVE-2020-7015)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the kibana package has been released.

ID	Name	Product	Family	Severity
113535	Kibana < 7.7.1 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
138442	Photon OS 1.0: Kibana PHSA-2020-1.0-0306	Nessus	PhotonOS Local Security Checks	medium
137874	Photon OS 2.0: Kibana PHSA-2020-2.0-0255	Nessus	PhotonOS Local Security Checks	medium
137780	Photon OS 3.0: Kibana PHSA-2020-3.0-0106	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2020-7015

medium

Tenable Plugins

medium

medium

medium

medium