Bug 2172353 (CVE-2022-23713)

Summary:	CVE-2022-23713 kibana: Kibana cross-site-scripting (XSS) issue (ESA-2022-08)
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, chazlett, eglynn, gmalinko, janstey, jcantril, jjoyce, jschluet, lhh, mburns, mgarciac, rhos-maint, slinaber, spower, tvignaud
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Kibana 8.3.0 and 7.17.5	Doc Type:	If docs needed, set a value
Doc Text:	A Cross-site-scripting (XSS) vulnerability was found in the Vega Charts Kibana integration. This issue could allow arbitrary JavaScript to be executed in a victim’s browser.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2176291, 2176292, 2176293
Bug Blocks:	2169677

Description Avinash Hanwate 2023-02-22 04:57:20 UTC

A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser.

https://discuss.elastic.co/t/elastic-8-3-1-8-3-0-and-7-17-5-security-update/308613

Comment 2 Anten Skrabec 2023-03-07 22:17:22 UTC

Created puppet-kibana3 tracking bugs for this issue:

Affects: openstack-rdo [bug 2176293]